brain-map-visualizer

• Outcome: Review
• Latest audit: Aug 25, 2026 · 3:39 AM UTC
• Version: 3.3.6

Overview

This is mostly a local journal-visualization skill, but it needs review because its parser can process and overwrite local journal-derived data during import and the API/auth/output instructions are inconsistent.

Review and patch the parser before installing: move all parsing/writing under buildBrainMap or a require.main guard, align the API route names and auth environment variable, set the access key for anything beyond localhost, and scope WORKSPACE_DIR and any bootstrap transcript source to only the journals you want analyzed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The earlier interaction sections state that the first click reorbits and the second click opens the file, but L176-L179 says that in project view a single click opens the node's file. These are mutually inconsistent user-intent descriptions for the same core behavior, so the documentation cannot be relied on to reflect what the implemented interaction is supposed to do.

Intent-Code Divergence

Low

• Confidence: 89% confidence
• Finding: The security section says the skill writes one JSON file named `brain-map-graph.json`, while the installation and API sections elsewhere describe output as `data/brain-map-projects.json`. This is an intent/documentation divergence about what artifact the parser actually produces and serves.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The file-level description says the component renders a project-centric brain map with ranking and a force-directed graph, which implies visualization-only behavior. However, the click handler dispatches a `brain-map:open-file` event with a concrete file path on second click, enabling navigation or file-reading behavior beyond mere visualization.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The manifest context describes a skill for visualizing attention movement, category edges, and sorted co-access relationships. Dispatching an event that requests opening a file by path introduces an operational capability affecting host application behavior that is not obviously required for visualization itself.

Intent-Code Divergence

Low

• Confidence: 96% confidence
• Finding: The note says the component is fully self-contained with no external state or context dependencies, but elsewhere the same document and code show it fetches `/api/brain-map/graph` and emits `brain-map:open-file` for the host to handle. Those behaviors create runtime dependencies on external infrastructure and host integration, contradicting the self-contained claim.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The manifest context describes a visualization-oriented skill and the file documentation says the parser exports `buildBrainMap(options)` for direct use and runs as a standalone CLI when invoked directly. However, the module performs journal parsing and writes `brain-map-projects.json` at top level before the exported API section, so merely requiring/importing the module triggers processing and output writes.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The text says the script can be called directly from API routes or other scripts without shell execution, implying safe library-style use. In reality, because lines L334-L460 run unconditionally and only the duplicate `buildBrainMap()` call is gated at L571-L573, importing this file still reads journals and writes output, contradicting the stated intent of side-effect-free direct invocation.

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: This markdown file includes a 'Bootstrap prompt for your agent' that tells the agent to 'Read my session history from [source]' and generate journal files, but it does not constrain what counts as an acceptable source or provide exclusion conditions. Because the trigger scope is not narrowly defined, an agent could apply it to overly broad conversation logs or unintended data sources.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The integration note states that a second click fires `brain-map:open-file` so the host can handle file reading, which is a user-data access operation. The document explains the behavior technically, but it does not clearly warn users that interacting with the graph can trigger file opening/reading behavior.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This markdown file embeds a script that writes to `data/brain-map-projects.json` and instructs users to copy and run it, but the surrounding description does not explicitly warn that executing it will create or overwrite a local file. For markdown files, user-facing documentation should disclose behaviors that affect user data or the filesystem.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The document explains that the parser scans `memory/journal/*.md`, extracts summaries, infers projects, and records file co-access, which involves processing potentially sensitive personal journal data. The markdown does not include any user warning about handling private journal contents or the sensitivity of the generated output.

Credential Access

High

• Category: Privilege Escalation

Content

keywords: [
      'github', 'git push', 'git commit', 'pull request', 'pr #', 'merge',
      'feature branch', 'main branch', 'hno-skills', 'ghost-theme',
      'pr open', 'pr merged', 'pat', 'personal access token',
    ],
  },
  {

• Confidence: 21% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.