Context Gatekeeper

• Outcome: Review
• Latest audit: Jul 10, 2026 · 4:19 AM UTC
• Version: 0.1.1

Overview

This is a local chat-summary helper, but it asks agents to keep conversation logs and run a background monitor without enough privacy, retention, or lifecycle controls.

Install only if you are comfortable with selected chat history being stored in local context files and reused in later prompts. Keep history short, remove secrets and personal or regulated data before logging, inspect current-summary.md before reuse, clear the context files when finished, and run the background monitor only when you deliberately need continuous updates.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill clearly instructs reading conversation history, writing summary artifacts, and invoking a Python script from the shell, yet it declares no permissions or equivalent capability boundaries. That mismatch is dangerous because it hides the skill's real access needs from operators and increases the chance of unauthorized file access, unintended overwrites, or execution in environments that rely on declared permissions for trust decisions.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: The README instructs operators to run `/session_status` and append token-usage footers to every reply, which expands the skill from context summarization into systematic collection and disclosure of session metadata. That metadata can reveal usage patterns, prompt sizes, or operational details that are unnecessary for the stated purpose and may be exposed to end users or retained in logs.

Context-Inappropriate Capability

Medium

• Confidence: 83% confidence
• Finding: The documented use of a persistent background monitor with auto-restart creates long-running behavior beyond the narrow purpose of generating summaries on demand. Continuous monitoring increases the attack surface, can process sensitive conversation data without explicit per-use consent, and makes unexpected persistence more likely after resets or restarts.

Context-Inappropriate Capability

Medium

• Confidence: 83% confidence
• Finding: The script runs as an infinite polling daemon that watches a conversation-history file and automatically reacts to changes. For a skill whose stated purpose is to prepare a compact briefing before each model call, this persistent monitoring broadens capability and creates unnecessary background access to evolving conversation data, increasing the chance of unintended data handling, excessive logging, or abuse as a stealthy resident process.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The README says to append every incoming and outgoing message to `context/history.txt` but provides no privacy warning, data classification guidance, or handling limits for sensitive content. In a conversation-management skill, that omission is risky because the logged material is likely to contain user secrets, proprietary information, or personal data.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The invocation guidance says to trigger the skill whenever a thread is bloated or the next prompt should be lean, which is broad enough to cause frequent automatic use across many conversations. In this skill's context, broad triggering increases exposure because every invocation encourages persistence and reuse of conversation content, including potentially sensitive material, without a gating check for user consent or data sensitivity.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs routine writing of full exchange history and replacement of a summary file, but it does not warn users that conversation contents will be persisted or that existing files may be overwritten. This is dangerous because it creates silent data handling and integrity risks: sensitive prompts may be stored on disk, and prior summaries can be destroyed without review or recovery.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script writes conversation-derived summaries, pending actions, and recent turns directly to a markdown file on disk, which can expose sensitive user or system content if the file is stored in a shared workspace, committed, or accessed by other tools. In this skill's context, the data being processed is explicitly conversation history, so persistence increases the confidentiality risk beyond a purely transient summarization step.

Ssd 3

Medium

• Confidence: 93% confidence
• Finding: The workflow requires preserving all user/assistant messages and recent turns in natural-language files, creating a durable record of potentially sensitive conversations. Because the skill's core function is to summarize context, this broad retention is especially dangerous: it concentrates raw conversational data in local artifacts that may be leaked, reused in prompts, or accessed by other processes.

Ssd 3

Low

• Confidence: 78% confidence
• Finding: Saving `/session_status` output together with each response can preserve operational metadata alongside conversation content, increasing correlation and disclosure risk if the files are shared or accessed later. While lower severity than full transcript logging, it still widens the data retained beyond what is needed for summarization.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The skill explicitly directs persistent logging of every user and assistant exchange and repeated reuse of those contents in future prompts via summary artifacts. This creates a substantial data retention and re-disclosure risk because sensitive information can be stored indefinitely, copied into new contexts, and exposed to other tools, users, or processes that can access the files.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.