Security audit

Privacy Guard

Security checks for vulnerabilities and agentic risk

Overview

The tool’s code mostly matches a local privacy scanner, but the package includes unredacted alert logs containing credentials and private conversation content.

Do not install this version without removing alert_log.md and rotating any exposed credentials. If you use the tool, run it locally only, leave webhook fields empty unless explicitly configured, and modify or monitor its reports so sensitive line previews are redacted or stored only as hashes.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Natural-Language Policy Violations

Critical

Confidence: 99% confidence
Finding: This log contains a plaintext API key embedded in natural-language chat content, which is a direct secret disclosure. Because the file is a broad alert/log artifact and not a secure secret store, anyone with access to the file could reuse the key for unauthorized API calls, data access, billing abuse, or lateral compromise of connected services.

Natural-Language Policy Violations

Critical

Confidence: 99% confidence
Finding: The file includes plaintext account credentials in chat/log text, which is a severe credential exposure. In a logging context this is especially dangerous because logs are often copied, retained, indexed, and shared more broadly than primary secrets, enabling account takeover and downstream compromise.

Ssd 4

High

Confidence: 89% confidence
Finding: The multi-turn narrative incrementally pushes the agent to install, initialize, and operationalize many skills with growing autonomy, including ongoing self-directed discovery and enablement. This is dangerous because it normalizes privilege expansion and persistence without strong approval boundaries, increasing the chance of unsafe tool use, data exfiltration, or configuration drift.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The content instructs the agent to persistently record and later recall the user's private holdings and transaction history, creating a durable store of sensitive financial data. In this environment, persistent memory raises the risk of unauthorized disclosure, over-retention, cross-session leakage, and misuse of highly personal investment information.

Ssd 3

High

Confidence: 97% confidence
Finding: The instruction combines building a skill for sensitive-data protection with the possibility of syncing or uploading it to GitHub, which creates a contradictory and risky workflow. This is dangerous because implementation artifacts, sample data, rules, or embedded secrets could be unintentionally published to a remote repository, defeating the stated goal of local protection.

Ssd 4

Medium

Confidence: 82% confidence
Finding: This progressive workflow pressures the agent to classify installed skills, mark which were used, and answer under narrowed constraints that suppress normal safety-oriented response behavior. That kind of conversational steering is risky because it can coerce the agent into disclosing operational details and bypassing cautious handling of internal capability state.

Static analysis

No suspicious patterns detected.