Personaldatahub

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:07 AM UTC
• Version: 0.1.0

Overview

This skill is broadly aligned with PersonalDataHub access, but its install path and credential handling are under-controlled enough to require review before use.

Review this skill before installing. Only use it with a trusted, local PersonalDataHub instance, avoid the unpinned npx setup path, restrict logs because they may contain API keys, and verify the packaged dist files match reviewed source before granting access to email, GitHub, or other personal data.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:9

Finding

Unpinned Remote Package Execution During Installation and MCP Startup

Content

View full analysis

Remediation

View remediation

... ``` 3. Prefer `npx --no-install pdh ...` after installing the locked dependency so startup cannot retrieve new code. 4. Verify package integrity and provenance in the release pipeline. 5. Do not change into or install the parent workspace from a Skill installation hook. 6. Run only the Skill's own locked build/install process from its project directory. 7. Disable unnecessary package lifecycle scripts or audit every lifecycle script before execution. 8. Document the exact package publisher, version, hash, and expected executable entry point. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: dist/index.js:66

Finding

Bearer API Key Is Automatically Created and Written to Application Logs

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: dist/hub-client.js:7

Finding

Unvalidated Hub URL Can Receive Bearer Credentials and Sensitive Action Content Over Plaintext HTTP

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: package.json:6

Finding

Deployed Runtime Artifact Contains Security-Relevant Behavior Absent From Reviewed Source and Tests

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (62)

Known Vulnerable Dependency: vitest==4.0.18 — 2 advisory(ies): CVE-2026-47429 (When Vitest UI server is listening, arbitrary file can be read and executed); CVE-2026-84373 (Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock)

Critical

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: vitest==4.0.18 — 2 advisory(ies): CVE-2026-47429 (When Vitest UI server is listening, arbitrary file can be read and executed); CVE-2026-84373 (Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock)

Critical

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The package declares vitest 4.0.18, which is flagged with critical advisories including arbitrary file read and possible code execution in Vitest UI/mocking-related scenarios. Even though vitest is a devDependency, development and CI environments are high-value targets, and compromise there can expose source, secrets, tokens, or taint build outputs.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description emphasizes that personal data is pulled through the PersonalDataHub access control gateway and filtered/redacted before reaching the agent. The prompt mostly aligns for Gmail and outbound email proposals, but it materially diverges for GitHub: it explicitly states GitHub is 'direct access' and that the agent should use its own GitHub tools directly, with PersonalDataHub only constraining repo boundaries. That is inconsistent with the declared representation that data access is mediated through the gateway. The code chunk is only a prompt declaration, not executable logic, so there are no triggers or runtime side effects to assess; however, the behavior it instructs includes an undeclared/inconsistent access pattern.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description says personal data such as emails and issues are pulled through the PersonalDataHub access control gateway, with data filtered, redacted, and shaped by the owner's policy before reaching the agent. However, the actual code explicitly states that GitHub is accessed directly using the agent's own GitHub tools/credentials, and that PersonalDataHub only controls repository boundary/permission constraints rather than mediating data retrieval through the pull tool. Gmail behavior aligns well with the description, including policy-based filtering/redaction and proposal-based outbound actions requiring approval. The mismatch is specific but material: one of the described data domains ('issues,' presumably GitHub issues) is not actually routed through the same gateway-mediated pull mechanism implied by the description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The declared description focuses on retrieving filtered/redacted personal data and proposing outbound actions through the PersonalDataHub access-control layer. The supplied code does not implement data access, redaction, issue/email retrieval, or drafting/reply proposal behavior. Instead, it implements setup and authentication bootstrap functionality: discovering a hub, checking its health, reading stored credentials, and creating an API key. Those are materially different capabilities from the declared purpose and include undeclared access/bootstrap behavior, so this is a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared purpose focuses on mediated access to personal data and action suggestion through an access-control gateway. This code chunk does not fetch emails/issues, apply redaction/filtering, or generate drafts/replies. Instead, it handles infrastructure/setup tasks: reading credentials, discovering a running hub, checking health endpoints, and provisioning an API key. API key creation is a sensitive capability not reflected in the description, so this is a material description-behavior mismatch rather than a mere supporting detail.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

Most of the prompt aligns with the description for Gmail: it describes pulling email data through PersonalDataHub, receiving filtered/redacted results, and proposing outbound email actions subject to owner approval. However, it materially diverges for GitHub. The declared description says the skill pulls personal data including issues through the PersonalDataHub access control gateway, but the code explicitly says GitHub is 'direct access,' that the agent should not use the pull tool for GitHub, and should instead use its own GitHub tools directly, with PersonalDataHub only controlling boundary constraints. That is a different resource access pattern and an undeclared capability path compared with the stated gateway-mediated model. No unrelated triggers are present.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

This code chunk's primary purpose is setup validation and hub discovery testing, not personal data retrieval or action proposal. While the notion of a 'hub' loosely relates to the declared PersonalDataHub concept, the actual behavior shown is limited to unit tests for health checking, endpoint probing, and config reading. There is no evidence here of pulling emails/issues, passing data through an access-control gateway, applying owner policy filtering/redaction, or generating drafts/replies. Therefore the description materially overstates and misrepresents what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description describes a data-access and action-suggestion skill operating through a controlled gateway. The supplied code does not implement any of those capabilities; it only configures the Vitest test runner to include test files under src and exclude dist and node_modules. This is a materially different primary purpose, so it is a clear mismatch.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

The skill is designed to access personal data, and its declared configuration order includes reading a credentials file from ~/.pdh/credentials.json. In an agent-integrated environment, automatic credential pickup materially increases the risk of unauthorized data access if the skill is invoked without the user's clear awareness or if another component can trigger it opportunistically.

Content

Scanner excerpt · dist/index.d.ts (reported line 10)May include surrounding context.

ts

* Config resolution order:
 *   1. Plugin config (hubUrl + apiKey passed directly)
 *   2. Environment variables (PDH_HUB_URL + PDH_API_KEY)
 *   3. Credentials file (~/.pdh/credentials.json, written by npx pdh init)
 *   4. Auto-discovery (probe localhost, create API key)
 */
export interface PersonalDataHubPluginConfig {

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · dist/index.js (reported line 10)May include surrounding context.

js

* Config resolution order:
 *   1. Plugin config (hubUrl + apiKey passed directly)
 *   2. Environment variables (PDH_HUB_URL + PDH_API_KEY)
 *   3. Credentials file (~/.pdh/credentials.json, written by npx pdh init)
 *   4. Auto-discovery (probe localhost, create API key)
 */
import { HubClient } from './hub-client.js';

Credential Access

High

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

The skill reads credentials from ~/.pdh/credentials.json, giving it the ability to consume locally stored secrets outside explicit plugin configuration. In an agent skill, this materially increases sensitivity because the plugin can silently elevate itself using preexisting credentials and access personal data the operator did not deliberately bind to this skill instance.

Content

Scanner excerpt · dist/index.js (reported line 65)May include surrounding context.

js

api.logger.info(`PersonalDataHub: Configured from environment variables (hub: ${envHubUrl})`);
            }
        }
        // Step 3: Check credentials file (~/.pdh/credentials.json)
        if (!config?.hubUrl || !config?.apiKey) {
            const creds = readCredentials();
            if (creds) {

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The code logs the newly created API key directly: Save this for your config: ${apiKey}. Secrets in logs are commonly exposed to operators, log collectors, crash reports, and other plugins, so this can immediately compromise hub access and defeat the intended access-control gateway.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 89% confidence

Finding

The package reads credentials from ~/.pdh/credentials.json, which is a sensitive local secret source. For a skill that processes personal data, direct credential-file access raises the risk of secret exfiltration, misuse by unrelated code paths, or overbroad access if file permissions and scoping are not tightly controlled.

Content

Scanner excerpt · dist/setup.d.ts (reported line 25)May include surrounding context.

ts

/** Path to the credentials file written by `npx pdh init`. */
export declare const CREDENTIALS_PATH: string;
/**
 * Read credentials from ~/.pdh/credentials.json.
 * Returns null if the file doesn't exist or is malformed.
 */
export declare function readCredentials(): Credentials | null;

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

createApiKey targets an unauthenticated local endpoint to mint credentials for the skill. Any code path that can reach that local hub may be able to silently create durable access, which is especially dangerous for a skill handling personal emails/issues even if the endpoint is intended to be owner-local.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

The code targets a credentials file in the user's home directory, indicating direct access to stored secrets. For an agent skill handling personal data, local credential access is highly sensitive because possession of the hub API key may allow broad, persistent retrieval of emails, issues, or other protected data.

Content

Scanner excerpt · dist/setup.js (reported line 12)May include surrounding context.

js

import { join } from 'node:path';
import { homedir } from 'node:os';
/** Path to the credentials file written by `npx pdh init`. */
export const CREDENTIALS_PATH = join(homedir(), '.pdh', 'credentials.json');
/**
 * Read credentials from ~/.pdh/credentials.json.
 * Returns null if the file doesn't exist or is malformed.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

readCredentials() parses and returns credential data from ~/.pdh/credentials.json, operationalizing direct secret access rather than merely referencing the path. That creates a concrete risk of unauthorized or opaque use of stored API keys in a context involving sensitive personal-data systems.

Content

Scanner excerpt · dist/setup.js (reported line 14)May include surrounding context.

js

/** Path to the credentials file written by `npx pdh init`. */
export const CREDENTIALS_PATH = join(homedir(), '.pdh', 'credentials.json');
/**
 * Read credentials from ~/.pdh/credentials.json.
 * Returns null if the file doesn't exist or is malformed.
 */
export function readCredentials() {

Known Vulnerable Dependency: nanoid==3.3.11 — 3 advisory(ies): CVE-2026-67214 (nanoid: non-secure generators can loop indefinitely with negative size); CVE-2026-67213 (nanoid: custom generators can loop indefinitely when size is zero); CVE-2026-73086 (nanoid: Integer Overflow or Wraparound)

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: picomatch==4.0.3 — 2 advisory(ies): CVE-2026-33672 (Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Mat); CVE-2026-33671 (Picomatch has a ReDoS vulnerability via extglob quantifiers)

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: postcss==8.5.6 — 4 advisory(ies): CVE-2026-45623 (PostCSS: Arbitrary file read and information disclosure via attacker-controlled ); CVE-2026-69153 (PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappi); CVE-2026-41305 (PostCSS has XSS via Unescaped </style> in its CSS Stringify Output) +1 more

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: vite==7.3.1 — 5 advisory(ies): CVE-2026-39365 (Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling); CVE-2026-53571 (vite: `server.fs.deny` bypass on Windows alternate paths); CVE-2026-39363 (Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket) +2 more

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill exposes installation and runtime behaviors that require network access and local environment/file access, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates an under-specified trust boundary where an agent may be induced to use broader capabilities than a reviewer or user expects, including reading local config under ~/.pdh and making HTTP requests to the hub.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The same unpinned npx pdh reference appears again and carries the same supply-chain exposure: runtime package resolution can fetch unintended code. In a skill that handles personal data and local configuration, that risk is amplified because a compromised package could access sensitive files or exfiltrate data.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 116)May include surrounding context.

Pull data:

bash

curl -X POST <hubUrl>/app/v1/pull \
  -H "Content-Type: application/json" \
  -d '{"source": "gmail", "purpose": "reason for pulling data"}'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This declaration defines a client configuration containing an apiKey and a hub URL for a personal data service, but the file provides no warning, comment, or user-facing disclosure about handling credentials or transmitting data to the hub. For code files, access to sensitive credentials and networked personal-data operations should have some visible disclosure unless clearly documented elsewhere in markdown, which is not present in this file.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.potential_exfiltration

Sensitive-looking file read is paired with a network send.

Warn

• Code: suspicious.potential_exfiltration
• Location: dist/setup.js:21