Security audit

pref0

Security checks across malware telemetry and agentic risk

Overview

This is a legitimate preference-memory skill, but it needs Review because it sends whole chats and stable user identifiers to a third-party service and can feed that service's returned prompt into future instructions.

Install only if you are comfortable with pref0 receiving and retaining conversation-derived data. Prefer opaque internal user IDs instead of emails or phone numbers, avoid tracking sensitive chats, use structured preferences rather than directly injecting the returned prompt, and use the delete endpoint when a user asks to reset or remove stored preferences.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Missing User Warnings

High

Confidence: 96% confidence
Finding: The skill explicitly instructs sending the full conversation history to a third-party API, but provides no requirement for user notice, consent, minimization, or redaction. Because conversations can contain sensitive personal, financial, medical, or credential data, this creates a substantial privacy and data-exfiltration risk.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The guidance recommends stable personal identifiers such as email, account ID, or phone number for cross-session tracking without warning about privacy implications or data protection requirements. Using direct identifiers increases linkability, retention risk, and harm if the external service is breached or misused.

Ssd 3

Medium

Confidence: 88% confidence
Finding: The skill is designed to persist preferences learned from conversations and reuse them later, including corrections and quoted user statements. Even if intended for personalization, this creates a natural-language data retention channel that can preserve sensitive user content across sessions and expose it in later contexts.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The skill recommends directly appending a third-party generated prompt into the system prompt. This can import untrusted prior-user content into a high-privilege instruction channel, creating prompt-injection, policy-conflict, and unintended disclosure risks across sessions.

Ssd 3

Medium

Confidence: 94% confidence
Finding: The workflow instructs operators to send the full message history for tracking, reinforcing cross-session retention and external sharing of user-provided content. In this skill's context, that materially increases the chance that sensitive data is stored, quoted as evidence, and later reused in prompts or responses.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.