Security audit

Design Daily Insights

Security checks across malware telemetry and agentic risk

Overview

This design-news skill is mostly coherent, but it publishes generated pages through a public reverse tunnel and supports recurring runs without enough explicit exposure controls.

Install only if you intentionally want generated digests published through a public link and sent on a schedule. Prefer disabling the locaddr.run tunnel and cron steps unless needed, serve only a dedicated output directory, and avoid including private sources, internal URLs, or sensitive summaries in generated pages.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The skill instructs starting a local HTTP server and exposing it through an SSH reverse tunnel to a public endpoint. For a design-news digest skill, this is unnecessary privilege expansion that can expose local files or generated content externally, and it introduces remote network publication capability beyond the stated curation purpose.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The documented deployment flow explicitly uses SSH tunneling to publish a locally served site to an external host. This creates an outbound remote access channel and publicly exposes local content, which is disproportionate to the skill's stated task of collecting and summarizing design news.

Context-Inappropriate Capability

Medium

Confidence: 87% confidence
Finding: The skill directs creation of cron jobs and executable helper scripts, enabling persistent automated execution outside a single user-invoked session. While automation itself is not always unsafe, here it expands operational reach and persistence for a content-digest skill without clear security boundaries or justification.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The README explicitly describes publishing each digest to a temporary public URL via a local HTTP server and locaddr.run tunnel, but it does not clearly warn users that anyone with the link may access the generated page. Because the skill aggregates fetched content and may include user-curated selections, this can unintentionally expose private workflow details, internal URLs, or sensitive summaries if users assume the page is only for local viewing.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill tells the agent to expose a local HTML site via a temporary public URL but does not require an explicit user-facing consent step warning that local content will be externally reachable. That omission increases the risk of unintentional data exposure, especially if the served directory contains additional files or if the generated page includes sensitive information.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.