Security audit

chatpipe-export

Security checks across malware telemetry and agentic risk

Overview

The skill has a legitimate chat-export purpose, but it can persist sensitive chat transcripts with broad activation and incomplete scoping or warnings.

Review before installing. Use this only for conversations you intentionally want saved to local disk, confirm the exact chat, format, and destination first, and redact secrets or private information before export. Also verify that the local ChatPipe script it invokes is trusted, because the transcript is passed to it for conversion.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill instructs the agent to run shell commands and write exported conversation data to files, but it declares no permissions. That creates a transparency and policy-enforcement gap: a reviewer or runtime may underestimate the skill's capabilities while it can still persist sensitive chat history to disk and invoke local tooling.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 84% confidence
Finding: The skill advertises broad one-click export and format support that is not actually implemented. Security-relevant behavior mismatches are dangerous because users and orchestrators may trust the description when deciding whether to invoke the skill, leading to unexpected data handling, shell execution, or failed conversions that expose or mishandle sensitive transcripts.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: Broad trigger phrases like 'export chat' and 'save conversation' can match common conversational requests and cause the skill to activate in situations where the user did not clearly consent to writing chat history to disk. In this context, accidental activation is more dangerous because the payload is sensitive conversation content and the documented outcome is persistent file creation in the workspace.

Vague Triggers

Medium

Confidence: 77% confidence
Finding: The activation guidance explains when to use the skill but not when not to use it, leaving room for over-activation on ambiguous user requests. Because the skill writes full chat histories to files, ambiguity increases the risk of unintended persistence of sensitive data and unnecessary shell/file operations.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill does not warn users that exporting will write potentially sensitive conversation history to workspace files. Absent that warning, users may trigger the skill without understanding retention, discoverability, or downstream access risks, especially if chats contain secrets, personal data, or proprietary information.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script writes full session content to a predictable file in the workspace and then exports derived output back into the same local workspace without any warning, consent flow, or retention controls. Chat transcripts commonly contain secrets, personal data, or internal prompts, so silent persistence materially increases confidentiality exposure on shared or backed-up systems.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The script forwards the full piped session transcript to an external tool (ChatPipe) without making that transfer explicit to the user. Even though ChatPipe appears local, handing sensitive conversation data to another program expands the trust boundary and can expose data if that tool is compromised, modified, or behaves unexpectedly.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.