Security audit

Backboard.io

Security checks across malware telemetry and agentic risk

Overview

The skill appears purpose-aligned, but it exposes a powerful Backboard backend in a way users should review before installing.

Review before installing. Use a dedicated Backboard API key, bind the backend to 127.0.0.1 instead of 0.0.0.0, avoid running it on untrusted networks, and require explicit confirmation before saving memories, uploading sensitive files, or deleting Backboard resources. Pin and audit dependencies before long-term use.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (9)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 77% confidence
Finding: The skill documents use of an environment variable (`BACKBOARD_API_KEY`) and a local backend, but there is no declared permission model or explicit capability boundary in the skill file. This creates a transparency and governance gap: operators may not realize the skill depends on privileged local infrastructure and secret-backed network actions.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The global 500 error handler returns the raw exception text to clients via the "detail" field. Internal exception messages often reveal stack details, library behavior, configuration problems, file paths, or backend service information that can help an attacker map the system and refine follow-on attacks. In a local backend integration service, this disclosure is not necessary for normal operation and increases exposure.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The trigger phrases for memory actions are broad and conversational, such as 'Remember that...' and 'Store this...'. This can cause unintended persistence, update, or deletion of user data from ordinary dialogue rather than clearly consented memory-management requests.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill description says it integrates with a local backend but does not clearly warn that user messages and uploaded documents may be transmitted to `http://localhost:5100` for processing. This is a material privacy notice omission because users may assume data stays within the assistant rather than being forwarded to an external service layer.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: Delete operations for assistants are exposed without warning or mandatory confirmation guidance. This increases the likelihood of accidental destructive actions that may remove assistants, related context, or user work irreversibly.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The memory feature describes persistent storage of user information but does not include a clear privacy warning about retention, sensitivity, or review/deletion options. Users may disclose personal or sensitive information without understanding it will persist across conversations.

Known Vulnerable Dependency: flask — 9 advisory(ies): CVE-2025-47278 (Flask uses fallback key instead of current signing key); CVE-2018-1000656 (Flask is vulnerable to Denial of Service via incorrect encoding of JSON data); CVE-2019-1010083 (Pallets Project Flask is vulnerable to Denial of Service via Unexpected memory u) +6 more

High

Category: Supply Chain
Confidence: 86% confidence
Finding: flask

Known Vulnerable Dependency: pydantic — 4 advisory(ies): CVE-2021-29510 (Use of "infinity" as an input to datetime and date fields causes infinite loop i); CVE-2024-3772 (Pydantic regular expression denial of service); CVE-2021-29510 (Pydantic is a data validation and settings management using Python type hinting.) +1 more

High

Category: Supply Chain
Confidence: 82% confidence
Finding: pydantic

Known Vulnerable Dependency: python-dotenv — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low

Category: Supply Chain
Confidence: 63% confidence
Finding: python-dotenv

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.