Security audit

Identity Manager

Security checks across malware telemetry and agentic risk

Overview

This skill is not malware, but it automatically creates long-lived identity records from ordinary conversation and should be reviewed carefully before installation.

Install only if you explicitly want an always-on identity memory system for the workspace. Before use, set IDENTITY_AUTO_SCAN=false unless you want ordinary mentions of people, groups, and organizations to create persistent files, and regularly audit or delete identity/, memory/hook_log.jsonl, and soul/identity_context.md.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (23)

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The file presents contradictory activation semantics: it says auto-scan can be disabled or limited to explicit use, but later mandates pre-response identity lookup and create/update behavior whenever relevant entities are mentioned. In a persistence-oriented identity skill, this ambiguity is dangerous because agents may default to always-on collection and storage despite user expectations or configuration, leading to unauthorized retention of identity data.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The documentation conflicts on whether the skill applies to every turn or only when relevant entities are mentioned. That inconsistency can cause an implementation to over-trigger, expanding collection scope and causing unnecessary identity extraction, disk writes, and cross-turn persistence of personal or sensitive information.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: Broad activation language creates unclear invocation boundaries for a skill that performs persistent writes. In this context, ambiguity is especially risky because the skill is designed to create and update identity records automatically, so any overbroad interpretation can silently capture user data beyond what is necessary for the current task.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: These instructions require immediate creation and updating of identity files before responding, without any user-facing notice or consent workflow. Because the skill manages person, organization, and group identities across sessions, silent automatic writes create a meaningful privacy and data-governance risk, especially when users may not realize ordinary conversation is being persisted.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill mandates automatic writes to memory and a persistent soul file for sensitive, flagged, or high-priority events, but does not require warning the user that this retention will occur. This is particularly dangerous because the triggered categories include 'sensitive: true' and blocked/flagged status, which can preserve highly sensitive inferences and labels in multiple locations.

Vague Triggers

High

Confidence: 98% confidence
Finding: The skill is configured to trigger on ordinary conversation whenever any person, organization, or group is mentioned, which is an extremely broad activation surface. In this context, broad triggering is especially dangerous because activation immediately leads to persistent extraction and storage of identity data across multiple files without requiring an explicit user command or fresh consent.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: Although the description mentions persistent context, it does not clearly warn that ordinary conversational mentions will automatically create or update identity, memory, and soul records. Users may reasonably disclose names or relationships in normal dialogue without understanding that this will trigger durable storage, creating a transparency and consent failure.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The file explicitly defines a 'soul-layer persistent context' that survives across sessions and stores workspace owner details, identity entries, groups, relationships, and activity history, but it provides no user-facing consent, notice, retention limits, or privacy controls. In an identity-management skill, this is especially risky because the data model is designed to accumulate sensitive personal and organizational context over time, increasing the chance of covert profiling, oversharing across sessions, and privacy violations.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The write protocol mandates recording 'recent events' and an append-only 'session log' for every session, yet there is no indication that users are warned that their actions and identity-related events are being continuously logged. Because this skill maintains cross-session identity state, the logging becomes more dangerous than ordinary telemetry: it can create a durable behavioral record tied to named people, organizations, groups, and relationship changes.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The hook description explicitly states persistent identity creation, updates, and memory write-through across sessions, but provides no user consent, notice, or scoping constraints. This creates a real privacy and data-governance risk because the agent is directed to persist personal and organizational information automatically before every response.

Missing User Warnings

High

Confidence: 98% confidence
Finding: These steps mandate a sequence of writes to identity, index, memory, and soul files before any response is composed, meaning persistence is automatic and unavoidable. In this skill's context, that is especially dangerous because it operationalizes undisclosed profiling and cross-session tracking for every mentioned entity, including third parties who never consented.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The hook requires appending extracted entities, group names, and operation metadata to a persistent JSONL log without any privacy warning or minimization. Persistent logging of user-derived names and profile operations increases exposure of sensitive relationship and identity data and creates secondary leakage risk beyond the primary identity store.

Vague Triggers

Medium

Confidence: 81% confidence
Finding: The template asks authors to record an AI persona's activation behavior but provides no constraints on who can trigger it, what signals are valid, or whether explicit user consent is required. In an identity-management skill with persistent memory, vague activation rules can lead to unintended invocation, cross-session auto-loading, or over-broad behavioral persistence tied to a person record.

Natural-Language Policy Violations

Low

Confidence: 70% confidence
Finding: The template encourages storing a preferred language/style for an AI persona without indicating that this should reflect explicit user choice. In a system that maintains persistent identity entries and memory write-through, this can normalize behavioral profiling or sticky personalization that the user did not knowingly approve.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The rules instruct the agent to persist identity details for every mentioned person, org, or group and carry that context forward across turns. In an identity-management skill, this broad default retention increases the chance of collecting unnecessary personal data, preserving incorrect inferences, and later disclosing or reusing data in contexts the user did not intend.

Ssd 3

Medium

Confidence: 89% confidence
Finding: Loading shared group attributes and pairwise dynamics into working memory whenever a member is mentioned can expose unrelated personal or relational data beyond what is needed for the current interaction. This broad contextual propagation is risky because group-linked identity information may include sensitive associations or assumptions that bleed into responses about a single person.

Ssd 3

High

Confidence: 98% confidence
Finding: Mandatory write-through of flagged, blocked, sensitive, and high-priority identity events into a persistent append-only soul file creates a strong retention and leakage risk. The danger is heightened by the file's append-only nature and by the fact that the triggers include sensitive classifications and organizational/group creation, making it easy to accumulate durable records of sensitive labels and associations.

Ssd 3

Medium

Confidence: 92% confidence
Finding: Requiring synchronized storage across identity entries, a master index, a JSON memory file, and the soul context normalizes broad duplication of identity data. This multiplies exposure surfaces, complicates deletion/correction, and increases the chance that sensitive information persists in one file even if removed from another.

Ssd 3

High

Confidence: 99% confidence
Finding: The skill mandates persistent collection and logging of identity data across sessions and additionally writes high/sensitive events into memory and 'soul' files. Even though some prohibited categories are listed, the design still normalizes broad retention of personal and potentially sensitive relational context, creating significant privacy, profiling, and unauthorized data accumulation risk if the workspace contains real user conversations.

Ssd 3

High

Confidence: 99% confidence
Finding: The per-turn workflow requires scanning every input and completing all storage operations before replying, effectively turning all conversations into a background identity-harvesting pipeline. This is especially dangerous here because the workflow is blocking and mandatory, so the agent is instructed to prioritize persistent writes over minimizing data collection or obtaining contextual consent.

Ssd 3

High

Confidence: 99% confidence
Finding: The decision tree enforces automatic extraction, creation, updating, syncing, and post-response verification for every mentioned entity on every turn. In the context of an identity-management skill, this creates a systematic surveillance-like mechanism that persistently records people and group relationships from ordinary dialogue, increasing the likelihood of overcollection, accidental storage of third-party data, and long-lived privacy harm.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The hook instructs the agent to scan the full user input for names and entities on every turn, which broadens collection well beyond what may be necessary to answer the user's request. Combined with this skill's persistent identity-management purpose, full-input scanning increases the chance of silently extracting and storing incidental or sensitive third-party information.

Ssd 3

High

Confidence: 97% confidence
Finding: This logging requirement persists discovered entities and queued updates from user input into hook logs, creating an additional durable record of personal data and inferred relationships. Because the skill runs before every response and cannot be skipped, the context makes it more dangerous: surveillance-like collection becomes systematic, not occasional.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.