Security audit

Devlog Skill

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward local developer journaling tool, with expected package-install and local-log retention risks users should understand.

Install only if you are comfortable with setup.sh installing Python tooling and dev-log-cli from PyPI at the user level. Avoid putting secrets, credentials, customer data, or sensitive incident details into devlog entries unless you have verified where the SQLite database is stored and how to delete or redact entries.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The script automatically installs pipx and modifies the user's PATH without any confirmation, which causes package-management actions and environment changes as a side effect of running the setup script. This is dangerous because it expands trust to external package sources and alters shell behavior implicitly, increasing supply-chain and unintended system-change risk.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The script installs dev-log-cli via pipx automatically, without prior confirmation or a warning that it will fetch and execute software from external package infrastructure. In an agent skill context, this is more concerning because setup may be triggered unattended, creating a supply-chain exposure and unexpected code execution path on the host.

VirusTotal

53/53 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.