DR Context Pipeline

• Outcome: Pass
• Latest audit: Jun 29, 2026 · 5:26 PM UTC
• Version: 2.1.1

Overview

This skill is a disclosed local memory/context helper; it writes setup and memory files as part of its stated purpose, with no evidence of hidden exfiltration or destructive behavior.

Install only if you want this agent to use local persistent memory as a default context source. Review the setup commands first, expect local changes to context_pipeline, AGENTS.md, and memory files, and avoid debug/audit modes or memory commits when the conversation contains information you do not want retained on disk.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (16)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill instructs the agent to read and modify workspace files and execute shell/Python commands, but it does not declare any permissions or capability boundaries. That makes the trust surface opaque: a user or host system may treat the skill as low-privilege while it can actually alter AGENTS.md, install files, and run validators/watchdogs, increasing the risk of unintended filesystem changes or command execution.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The activation prompt includes a block of shell commands that installs software, writes into the workspace, runs validation scripts, and inspects git state. Embedding operational commands inside a prompt for a context-loading skill creates a prompt-to-action pathway where an agent may perform file-system changes and command execution that are not necessary for answering the user’s request.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The document requires persistence of runtime artifacts such as retrieval bundles, context packs, reasoning summaries, and audit ledgers, but it does not require explicit user notice, consent, retention limits, or redaction guarantees. Because these artifacts can contain pipeline context and potentially sensitive user-derived data, writing them to disk increases the risk of unintended disclosure through local access, backups, logs, or later reuse.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The router relies on case-insensitive substring matching with many generic terms such as 'error', 'missed', 'plan', and 'why', so ordinary user phrasing can be misclassified into the wrong task type. In a context/memory pipeline, misrouting changes which retrieval rules and data sources are consulted, which can cause irrelevant or overly broad context inclusion and degrade safety or correctness guarantees.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The qna triggers include extremely common phrases like 'what is', 'how do', 'why', and 'explain', which will match a large fraction of normal conversation. Because this router is first-match-wins, these vague patterns can suppress more appropriate routing or steer retrieval toward the wrong context set, increasing the chance of incorrect answers or unintended memory access patterns.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger phrase at this location appears to be a broad natural-language request pattern tied to briefing-mode routing. Because phrases like 'Daily briefing please' are common everyday speech, they can be activated unintentionally or manipulated to steer the pipeline into a different task type than the user actually intended. In this test harness, the overlap is explicit and demonstrates that routing depends on ambiguous phrasing rather than stronger disambiguation signals.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The trigger phrases are generic conversational commands like "memorize this" and "store this," which can easily appear in normal dialogue and cause the workflow to activate unintentionally. In this skill, activation leads directly to persistent writes into local memory files, so accidental invocation can store sensitive or irrelevant content without deliberate user consent.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The workflow instructs the agent to append and edit multiple persistent files under a local workspace, but it does not require a user-facing disclosure or confirmation that durable data will be written to disk. Because the content being committed may include session summaries, decisions, and follow-ups, this can create unintended retention of sensitive information and a mismatch between user expectations and actual persistence.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The markdown provides file-modifying install and validation commands without a clear warning that they will change the workspace, overwrite skill files, and execute local scripts. In an agent-skill context, such instructions are risky because they can be copied into automated execution paths or followed by users without understanding the side effects.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The ops route uses many generic substrings such as "error," "failed," and "missed," and routing is first-match-wins. That makes it easy for unrelated user messages to be classified as ops, which can pull in operational context and change downstream handling in ways the user did not intend.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: Phrases like "review this" and "rewrite" are common in ordinary conversation and can easily over-match. In this skill, misrouting to doc_review is less severe than ops, but it can still alter retrieval and prompt framing, causing the agent to apply the wrong validation or editing behavior.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The debugging route includes broad triggers like "not working," "logs," and "trace," which are common outside actual debugging contexts. Because routing is deterministic and affects retrieval scope, an attacker or accidental phrasing could steer the system into debugging mode and expose irrelevant technical context or degrade task handling.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: Triggers such as "design," "implement," "plan," and "recommend" are extremely broad and likely to appear in many unrelated requests. This can cause frequent planning-mode misclassification, leading to irrelevant memory retrieval and potentially misleading responses, though the security impact is lower than routes that include sensitive logs.

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: Openers like "what is," "how do," and "why" are nearly universal in user messages, so they are too broad for deterministic routing. Although this mostly risks incorrect behavior rather than direct data exposure, it can suppress more appropriate task types and reduce reliability of downstream controls.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The retrieval policy allows daily logs to be included for ops and briefing tasks, and the trigger model can be reached through broad substring routing. Historical daily logs often contain sensitive operational details, so retrieving them without explicit user consent, minimization, or strong recency gating creates a real risk of overexposing internal context.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The test fixture encodes a very broad routing trigger: a plain request like "Daily briefing please" is sufficient to force briefing mode. Broad natural-language triggers can cause unintended mode selection for ordinary user wording, making the system over-collect topic-specific context or bypass more appropriate intent classification paths. In this file, the surrounding cases explicitly test overlap between briefing, planning, doc-review, and ops intents, which confirms this ambiguity is real rather than hypothetical.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.