Security audit

Ml Visualizer

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local plaintext logging tool presented as an ML visualization/model-selection tool, so users may store sensitive workflow details under misleading expectations.

Review carefully before installing. Treat this as a local activity journal, not a real ML visualizer, and avoid entering secrets, customer data, private dataset paths, proprietary schema details, credentials, or sensitive model notes unless you are comfortable with them being stored in plaintext local logs.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (11)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill presents itself as a Yellowbrick-style ML visualization and model-selection tool, but the documented behavior is a shell-based persistent logging utility. This mismatch is dangerous because users may provide dataset details, schema information, queries, or pipeline notes under the assumption they are using an analysis tool, while their inputs are actually being stored in plain-text local history and export files.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script’s advertised purpose is ML visualization and model-selection tooling, but the implementation is a generic local logging utility that stores arbitrary user input. This mismatch is dangerous because users may trust the skill with dataset names, prompts, paths, or sensitive workflow details under false expectations, leading to unintended data retention and exposure through built-in search/recent/export features.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The 'visualize' command does not visualize data; it simply persists user input to a log and echoes it back. In the context of a skill marketed for ML analysis, this is risky because users may provide model, dataset, or experiment details expecting computation rather than storage, increasing the chance of inadvertent disclosure.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest advertises ML visualization/model-selection functionality, but the skill content describes a generic local activity logger and exporter. This deceptive packaging can cause users to entrust sensitive ML workflow details or dataset metadata to a tool whose real behavior is persistent recording rather than analysis.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The documentation claims ingestion, transformation, query, filtering, aggregation, and visualization capabilities, but then explains that commands merely record or display log entries. This can mislead operators into entering sensitive operational data, queries, schema definitions, or pipeline descriptions believing processing is occurring, when the primary effect is durable plaintext storage.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill omits a prominent warning that command inputs are persistently written to local plain-text log files and can later be exported. In the ML/data-pipeline context, users may paste dataset locations, schema details, internal queries, model metrics, or other sensitive operational information, creating avoidable confidentiality and compliance risks.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documented design explicitly stores all user-provided activity in plain-text history files and supports export of the full log corpus. In a data-science workflow, that can expose sensitive dataset metadata, internal processing notes, schema definitions, storage locations, and potentially pasted secrets to other local users, backups, or accidental sharing through exported files.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script is designed to collect arbitrary user-provided content into plaintext logs and then expose that content via search, recent, status, and export workflows. In skill context, this increases danger because the tool poses as ML visualization software rather than a logger, so users are less likely to realize their inputs become a browsable local datastore.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The help output documents export as a format-based export feature, and the file defines an _export function to do that. However, the case statement contains an earlier export branch that treats export as generic input logging, so the later documented export handler is effectively shadowed and contradicts the documented behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: User input is written verbatim to persistent local log files without any warning, consent, minimization, or redaction. This is dangerous because users may enter sensitive data such as file paths, dataset identifiers, tokens, or internal notes, which remain stored on disk and may later be readable by other local processes or users depending on environment permissions.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Commands such as 'ingest', 'transform', 'query', 'visualize', and 'export' conventionally suggest that the tool performs those actions. The adjacent descriptions explicitly say these commands merely record or log the action, creating an intent-level contradiction between the apparent function implied by the interface/documentation and the actual behavior described.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.