Security audit

Natural Language Response

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed local reply formatter that makes Chinese AI responses more casual and stores small local conversation state for that purpose.

Install this only if you want outgoing replies automatically rewritten in a more casual Chinese style. Disable it or raise formal_level for legal, medical, financial, incident-response, audit, or other wording-sensitive conversations, and periodically clear memory/reply_state.json if local topic/session metadata should not be retained.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill documentation indicates file read/write capabilities via runtime state inspection and mutation (`cat memory/reply_state.json`, editing JSON, deleting the state file), but no declared permissions are present. Undeclared persistence and filesystem access weaken transparency and consent, and can lead to unexpected data retention or modification in environments that rely on declared permissions for policy enforcement.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The formatter persists per-session conversation metadata to disk even though its stated purpose is only reply-style transformation. This creates unnecessary retention of session identifiers, timestamps, topic markers, and greeting behavior, which expands the privacy and attack surface if local files are exposed, copied, or reused across users.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The code stores conversation/session metadata on disk without a clear need tied to the declared functionality of making replies sound more natural. Undocumented stateful storage can leak behavioral data, enable cross-session correlation, and violate least-privilege expectations for a simple text formatter skill.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The README explicitly states the skill is automatically applied and intercepts all replies, but it does not clearly warn users that every outgoing response will be modified before delivery. This creates a transparency and integrity risk: users or operators may unknowingly deploy a component that rewrites messages system-wide, which can alter meaning, tone, or compliance-sensitive wording.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The skill states it runs automatically before messages are sent and modifies user-facing replies, but does not provide an explicit warning that outputs are being transformed for style. Silent pre-send rewriting can affect output integrity, user trust, and the reliability of responses in sensitive contexts where exact wording matters.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The documentation includes direct deletion instructions for the state file (`rm memory/reply_state.json`) without warning about irreversible loss of conversation state. Even if framed as maintenance, destructive commands in skill docs can cause accidental data loss, disrupt behavior, and encourage unsafe operator actions.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.