Security audit

Tmp.Rd8dBLUSJc

Security checks across malware telemetry and agentic risk

Overview

This skill is purpose-built for Credit Karma access, but it asks users to expose and persist live financial session cookies in plaintext workflows.

Review carefully before installing. Only use this in an environment where you are comfortable granting a local MCP server access to your Credit Karma session and transaction history. Treat CK_COOKIES and copied Cookie headers like passwords: do not paste them into shared chats, do not commit .env or .mcp.json files, restrict local file access, and know how to sign out or revoke sessions if the cookies are exposed.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The documented workflow goes beyond ordinary transaction access by instructing use of a tool that stores full authenticated Credit Karma cookies into a local .env file. Session cookies are bearer credentials; persisting them in plaintext increases the chance of credential theft, lateral misuse, or accidental disclosure through logs, backups, or source control.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The skill describes reading HttpOnly Credit Karma cookies via a Chrome extension and then using them from Node to access the API. Bypassing normal browser isolation around HttpOnly cookies and repurposing them as API credentials is highly sensitive behavior consistent with credential harvesting patterns, even if intended for convenience.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger language is broad enough to activate on general personal-finance requests, which can cause the assistant to invoke a sensitive financial-data skill when the user did not clearly request Credit Karma access. In this context, over-triggering increases privacy risk because the skill can initiate authentication-related flows and local syncing of financial data.

Missing User Warnings

High

Confidence: 94% confidence
Finding: The skill handles highly sensitive financial data and session credentials but does not present a prominent warning about the risks of local sync, cookie handling, persistence, and exposure in chat/config files. In a finance context, missing consent and safety messaging materially increases the chance that users disclose account credentials or unknowingly store sensitive data insecurely.

Ssd 3

High

Confidence: 99% confidence
Finding: The instructions explicitly tell users to copy and paste full authenticated Cookie headers from DevTools into config or a tool call. That exposes live session credentials in plaintext to the assistant workflow and to local files, creating a direct account-compromise risk if the values are logged, retained, shared, or stolen.

Ssd 3

High

Confidence: 98% confidence
Finding: The auth tool description explicitly asks for full signed-in cookies and stores them for later use. This encourages both exposure and persistence of bearer credentials, which is especially dangerous for a financial service because anyone with the cookie can potentially act as the user until expiry.

Ssd 3

High

Confidence: 99% confidence
Finding: The workflow repeats guidance to paste authenticated Cookie headers into config or send them through a Claude tool call, normalizing insecure handling of account credentials. Repetition in setup documentation makes accidental disclosure more likely and increases the probability users will expose sensitive sessions in places not designed for secret storage.

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

Category: YARA Match
Content: Three onboarding paths, in priority order: **1. fetchproxy extension (easiest — no env vars):** Install the [fetchproxy 0.3.0 extension](https://github.com/chrischall/fetchproxy), sign into creditkarma.com once, and leave `CK_COOKIES` **unset**. The MCP reads HttpOnly `CKAT` + `CKTRKID` cookies on the first tool call via `chrome.cookies.get`, then operates direct-to-API from Node. **2. ck_set_session MCP tool:** From within Claude, call `ck_set_session` with a Cookie header you copied from DevTools (see below). The tool persists it to `.env`.
Confidence: 96% confidence
Finding: COOKIES` **unset**. The MCP reads HttpOnly `CKAT` + `CKTRKID` cookies on the first tool call via `chrome.cookies.get`, then opera; cookies on the first tool call via `chrome.cookies.get`, then opera;

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.