Security audit

stellar-trails

Security checks across malware telemetry and agentic risk

Overview

This workflow skill is not plainly malicious, but it automatically performs credential, network, file, self-update, and background-server actions that are too broad for routine use.

Install only if you explicitly want an always-on workflow framework that may start a local preview server, write persistent logs, self-update, and use a GitHub PAT from the documented path. Avoid it in workspaces where automatic credential setup, global git config changes, port 3000 process management, or cross-session profile/worklog storage are unacceptable.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (54)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill is described as a universal workflow framework, but the body mandates unrelated operational behavior including starting a local server, supervising processes, writing persistent files, and killing listeners. This mismatch is dangerous because users or orchestrators may invoke it expecting harmless process guidance while it actually performs side effects and persistent runtime management on every task.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The activation path automatically reads a PAT from disk, configures global git identity, and writes credentials to ~/.git-credentials during every activation. That is unrelated to workflow orchestration and creates credential-handling side effects without task-specific need or user consent, expanding the blast radius if the skill is invoked for ordinary work.

Context-Inappropriate Capability

High

Confidence: 94% confidence
Finding: The embedded GitHub operations toolkit greatly exceeds the advertised scope of a workflow wrapper by enabling broad authenticated API access and repository operations. Bundling this capability into the skill increases the chance that a generic invocation leads to sensitive network actions or token use in contexts where the user did not intend repository access.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The manifest frames the skill as a workflow wrapper, but activation mandates network calls, self-updates, file synchronization, process control, and persistent logging before ordinary work. This creates hidden side effects on every invocation and defeats user expectations about least privilege and minimal execution.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: Automatically starting and restarting a background popup server and manipulating processes is not justified by the stated workflow role. This can interfere with the host environment, occupy ports, and terminate unrelated listeners if detection is imprecise.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The skill performs persistent cross-session memory accumulation and user-profile extraction beyond its stated workflow-enforcement purpose. Storing durable behavioral patterns and preferences without explicit per-use consent creates privacy and persistence risks, especially in shared or multi-session environments.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The skill is presented as an internal workflow/enforcement framework, but this script exposes the .zscripts directory over an HTTP server bound to 0.0.0.0, making it reachable from outside the local host if network access exists. That behavior is unrelated to the declared purpose and can disclose skill files, prompts, scripts, or other sensitive project artifacts, which makes the mismatch itself highly suspicious in this context.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The code launches a persistent Python HTTP server and continuously restarts it, creating durable network-serving behavior that is not justified by a task-workflow skill. Because it serves the current working directory, it can expose internal scripts and configuration files, and the infinite restart loop makes the exposure resilient even after failures or attempted shutdowns.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: The script inspects the listener on the configured port and forcefully terminates it if the process name is python3/python, without verifying ownership or that it is actually this script’s orphaned child. In a workflow skill, this is unjustified destructive behavior that can disrupt unrelated services and can be abused to kill legitimate local development or agent processes bound to that port.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The comments narrow the behavior to 'its own orphaned child,' but the implementation only checks whether the listener name is python3/python, so any Python service on that port may be terminated. This discrepancy increases risk because it conceals broader kill behavior behind reassuring commentary, which can mislead reviewers and users about the true blast radius.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The eval requires the skill to perform web-search and inline research behavior even though the skill is described as a workflow-enforcement framework, not a research or browsing capability. This creates scope creep and can pressure the agent to invoke networked or higher-privilege behaviors unrelated to the user’s task, increasing attack surface and making the skill harder to constrain safely.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The eval expects execution of an external inspection command, 'clawhub inspect stellar-trails', which is operational behavior unrelated to simple workflow orchestration. Requiring arbitrary external command execution expands the skill’s capabilities beyond its stated purpose and could normalize shell access patterns that an attacker may later abuse for command execution or environment probing.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The eval requires writing activation artifacts to /tmp and a persistent log file, despite the skill being presented as workflow discipline rather than filesystem state management. Persistent and cross-task artifacts can create covert state, leak task history, enable tracking across sessions, and violate least-privilege expectations for a skill that should mainly influence process rather than modify the environment.

Description-Behavior Mismatch

Medium

Confidence: 98% confidence
Finding: The profile records a persistent personal access token location and explicitly encodes credential-retention behavior. For a workflow/framework skill, retaining or normalizing where a PAT is kept is unnecessary sensitive-data handling that can facilitate credential misuse, exfiltration, or unauthorized repository operations if the skill or downstream tooling reads from that path.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The profile goes beyond remembering workflow preferences and preserves a behavior of keeping credentials available until sandbox closure. That creates an unjustified secret-retention norm, increasing the window for accidental disclosure, unauthorized reuse, or abuse by any component that can inspect profile memory or the filesystem.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The procedure shifts from error diagnosis into prescriptive repository state changes by directing agents to synchronize and pull from remote during stale-data analysis. In an always-on skill, this broadens authority and can trigger unintended state changes, especially because git operations affect the whole workspace and may overwrite assumptions, invalidate ongoing work, or create cascading follow-on actions.

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: The git guidance is internally inconsistent: earlier text says not to run pull/rebase/merge without explicit user instruction, but later stale-data handling instructs `git pull` automatically. Contradictory safety rules are dangerous because agents may follow the more specific later instruction and perform repository-changing actions without consent.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The skill mandates external web research and inline content retrieval during SPECIFY, expanding the agent's behavior beyond a purely internal workflow into network-enabled data acquisition. In a skill that claims to activate broadly and automatically, this can cause unintended outbound requests, retrieval of untrusted content, and privacy/context leakage without clear task-scoped consent.

Description-Behavior Mismatch

Low

Confidence: 96% confidence
Finding: The workflow instructs the agent to append task details, phase trace, and file activity to a fixed local path under /home/z/my-project/worklog.md. Persistent logging to a hard-coded file creates undisclosed statefulness, can store sensitive user/task data across sessions, and may affect unrelated projects if the path exists in a real environment.

Description-Behavior Mismatch

Low

Confidence: 95% confidence
Finding: The incident protocol also writes incident details to the same undisclosed persistent worklog, which increases sensitivity because incidents often contain errors, environment details, or partial task contents. This compounds the hidden storage issue and may preserve sensitive operational context without user awareness.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: This file materially expands the skill beyond its declared workflow-orchestration purpose by documenting how to modify a popup landing page, web server, proxy path, and deployment flow. That kind of hidden or under-disclosed capability increases supply-chain and trust risk because users may install a seemingly generic workflow skill that also manipulates served content and preview infrastructure.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The instructions describe maintaining a persistent background process and local HTTP service using crash-restart loops and double-fork detachment, which are capabilities not justified by the advertised workflow framework. In agent skills, persistence and local service management are sensitive because they can be repurposed to evade normal task lifecycles, continue running after the invoking shell exits, and expose or alter content without clear user awareness.

Vague Triggers

High

Confidence: 97% confidence
Finding: The activation scope is so broad that it effectively claims authority over nearly every user request, causing all of the skill's side effects to trigger in ordinary sessions. In combination with hidden network, credential, and process actions, this makes accidental over-application substantially more dangerous.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The description omits clear notice that activation can perform network calls, start services, write persistent files, and modify git credential state automatically. Missing disclosure undermines informed consent and makes the hidden side effects materially more dangerous in routine use.

Natural-Language Policy Violations

Medium

Confidence: 78% confidence
Finding: Encoding a stable language preference in persistent user-profile memory without explicit per-use consent can cause undesired personalization and retention of behavioral data. While lower severity than credential issues, it still represents unauthorized preference capture and reuse across tasks.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.