Security audit

cat-sticker

Security checks across malware telemetry and agentic risk

Overview

This is an offline sticker-matching skill with disclosed local state, but users should know it can auto-trigger often and returns local file paths.

Install only if you want automatic sticker insertion in chats. Consider lowering sticker probability, adding cooldown, or disabling automatic use in sensitive conversations because the skill can react to ordinary words and may expose its local install path in returned media metadata.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill documentation describes persistent reads and writes to local JSON files, but no permissions are declared. That creates a trust and containment gap: a host may load the skill expecting a harmless sticker feature while it can modify local state, and in some runtimes undeclared file access weakens policy enforcement and review. The risk is amplified because the writes are automatic on first use and during cooldown tracking, not just explicit admin actions.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The declared purpose presents the skill as an emotion-to-sticker mapper, but the document also exposes absolute local file paths and performs persistent local state changes. That mismatch can mislead operators and downstream agents about the true data exposure and side effects, which is dangerous because local path disclosure can reveal host filesystem layout and make chaining with other components easier. Hidden persistence also increases the risk of unexpected behavior across sessions.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The function documentation says callers will get a non-absolute sticker reference, but the implementation also returns `sticker_path`, an absolute filesystem path derived from the local installation directory. Exposing absolute paths can leak deployment layout, usernames, container mount points, or other host details to downstream callers and logs, which can aid reconnaissance and chaining with other issues.

Vague Triggers

Medium

Confidence: 76% confidence
Finding: The skill says it will automatically analyze user input and attach stickers, but it does not define clear trigger boundaries or exclusion conditions. In an agent setting, ambiguous auto-trigger scope can cause unintended invocation on sensitive or system-originated text, leading to unwanted file access, persistent state updates, or disclosure of local sticker paths in contexts where no media should be attached.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: Several trigger keywords are generic everyday terms such as '好', '可以', '收到', '什么', and '为什么', which makes accidental activation likely. In this skill's context, overbroad matching can cause persistent cooldown/config side effects and unnecessary media/path outputs during ordinary conversation, increasing both privacy leakage and operational noise.

Vague Triggers

High

Confidence: 96% confidence
Finding: The keyword map contains many extremely broad triggers such as single common words or punctuation-like tokens (for example '？', '好', '行', '想', '嗯', '吃', '猫'), combined with probability 1.0 and zero cooldown. In this sticker skill context, that can cause the agent to inject stickers on ordinary conversation without meaningful user intent, creating prompt-behavior hijacking of responses, degraded reliability, and easy abuse by users to force repeated non-text output.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.