Security audit

Codegraph Assistant

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed wrapper around a local code indexing tool; it reads/indexes project code and can write a generated summary to MEMORY.md when the user runs those commands.

Install only if you trust the global npm codegraph tool and want the selected repository indexed. Use inject cautiously because it changes MEMORY.md without a backup or confirmation; review that file afterward in sensitive projects.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 96% confidence
Finding: The skill advertises capabilities to read files, write files, and execute shell commands, but the manifest shown in SKILL.md does not declare permissions or constraints. That creates a trust and review gap: a caller may invoke the skill without understanding that it can scan repositories, run external tooling, and modify MEMORY.md, increasing the chance of unintended data exposure or workspace modification.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The description presents the skill as a one-click assistant for project structure, indexing, and impact analysis without defining clear invocation boundaries, approved environments, or data-scope limits. Broad natural-language positioning can cause over-triggering in unrelated contexts, leading the agent to launch repository scans or shell commands more readily than the user intended.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: Examples like ask "问题描述" imply that arbitrary natural-language prompts can be converted into commands and context-generation actions without explicit restrictions. In a skill that wraps shell execution and repository indexing, this broad trigger style increases the risk of unintended invocation, excessive context collection, or processing of sensitive code when the user only asked a general programming question.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The markdown mentions inject as a convenience feature but does not clearly warn that it writes generated summaries into MEMORY.md. Silent or under-documented writes are dangerous because they persist derived repository context, may contaminate future agent behavior, and can store sensitive project details in a file users did not realize would be modified.

Missing User Warnings

Low

Confidence: 82% confidence
Finding: The setup workflow is described as a simple one-time initialization but does not warn that it will scan and index the repository and generate contextual metadata. In security-sensitive or proprietary codebases, undisclosed scanning can expose more code than expected to downstream tooling and create artifacts that users may not realize were produced.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The inject command modifies MEMORY.md in the target project without confirmation, backup, or clear notice, which can overwrite or remove prior content under the same marker. In an agent skill context, silent file mutation is more dangerous because it can unexpectedly alter project state and persist tool-generated content that may influence later workflows or prompts.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.