Security audit

Tmp.UMIBPKtSMT

Security checks across malware telemetry and agentic risk

Overview

This read-only AllTrails helper should be reviewed because it can use a signed-in browser session to read private AllTrails account activity without explicit consent prompts.

Install only if you are comfortable with an agent using your signed-in AllTrails tab to read account-linked data. Keep use to explicit requests, review commands before account-scoped calls, avoid shared browser profiles, and remember the fpx pairing persists until removed.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The invocation description is broad enough that an agent could select this skill in contexts that merely mention AllTrails, even when the user did not intend browser-mediated access to signed-in account data. Because the skill operates through a live authenticated tab, overbroad triggering increases the chance of unnecessary access to private data or unintended use of a privileged browser session.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The description advertises access to a signed-in user's saved lists, completed trails, and activity feed without an explicit privacy warning. In skill-selection or agentic contexts, that omission can mislead users or downstream systems into invoking a capability that touches private account data without clear notice or consent.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The documentation explicitly shows how to query the signed-in user's profile identifier via `/api/alltrails/me` without any privacy notice, consent guidance, or scope limitation. In this skill context, that identifier is a pivot to additional account-linked endpoints, so normalizing its retrieval increases the chance of unnecessary collection of personal account data.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: These sections document access to saved lists, completed trails, and activity feeds tied to a user ID, including personal notes, timestamps, and activity details, but provide no warning that this may expose personal or behavioral data. Because the skill is designed to operate through a signed-in browser session, the examples lower the barrier to harvesting authenticated user data from the current account or inspecting another user's accessible profile data without explicit consent checks.

Ssd 3

High

Confidence: 98% confidence
Finding: The skill explicitly enables querying a signed-in user's private AllTrails data through the user's browser session. In an agent setting, this creates a direct path to sensitive account information via ambient browser authentication, which is dangerous if invoked without explicit, informed consent and tight scoping.

Ssd 3

High

Confidence: 97% confidence
Finding: The instructions tell the operator to capture a live application header from authenticated browser traffic and reuse it in later requests. Even if the header is described as anonymous, operationalizing interception and replay of request metadata from a signed-in tab weakens trust boundaries and normalizes extraction of browser-derived auth/session context for API access.

Ssd 3

High

Confidence: 98% confidence
Finding: These setup steps operationalize use of a live signed-in browser tab and session-derived context to access per-user endpoints. That makes the skill more dangerous than a normal API client because it leverages ambient browser authentication, increasing the risk of silent data access from a user's existing session.

Ssd 3

High

Confidence: 99% confidence
Finding: The skill gives step-by-step instructions to obtain the signed-in user's identifier and then use it against account-specific endpoints such as lists, completed trails, and activity feed. In context, this is effectively a playbook for extracting private account data via the browser session, which is especially risky in autonomous or semi-autonomous agent workflows.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.