Security audit

Identity Compass

Security checks across malware telemetry and agentic risk

Overview

This skill appears to be a local decision-journaling tool, but it asks the agent to silently build and persist a sensitive profile from normal conversations.

Install only if you are comfortable with an agent building a long-term local profile from normal conversations. Before use, decide where the vault and JSON files will live, inspect what gets written, and avoid sensitive conversations unless you can disable background capture or require explicit confirmation before saving signals.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (20)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill instructs the agent to read and write persistent files in an Obsidian vault and under scripts/, but no explicit permissions or user-facing disclosure are declared. This creates a capability/expectation gap where the agent may handle local data stores without clear authorization boundaries, increasing the risk of unintended data access or persistence.

Description-Behavior Mismatch

Medium

Confidence: 98% confidence
Finding: The skill says background signal detection runs continuously and that the user is not aware of it, while logging inferred personal signals from normal conversation. Covert collection of sensitive preference, emotional, and identity-related data is dangerous because users cannot meaningfully consent, correct, or limit the profiling being created about them.

Description-Behavior Mismatch

Low

Confidence: 93% confidence
Finding: The protocol explicitly directs saving inferred user priors to `obsidian-vault/compass/prior/`, creating persistent storage of sensitive psychological/profile data derived from conversation. Even if framed as product functionality, storing latent identity and values vectors without clear consent, retention limits, or access controls materially increases privacy and misuse risk.

Context-Inappropriate Capability

Low

Confidence: 92% confidence
Finding: The page loads fonts from fonts.googleapis.com, which creates external network requests whenever the visualizer is opened. This leaks user metadata such as IP address, timing, and user agent to a third party and introduces a supply-chain/dependency surface unrelated to the core visualization function of the skill.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The activation conditions are broad enough to match ordinary conversation topics such as career discussion, preferences, or life questions, which can cause the skill to engage without a clear user request. In the context of a tool that persistently records inferred personal values and decisions, overbroad triggering increases the chance of collecting and storing sensitive behavioral data unexpectedly.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The README says the agent activates automatically and extracts vectors silently in the background from normal conversation, but it does not pair this behavior with an explicit consent notice at the point of collection. Because the captured material concerns identity, preferences, and life decisions, silent collection creates a substantial privacy and trust risk even if data remains local.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The README advertises automatic activation on very broad conversational triggers such as career discussion, preferences, rejection, excitement, and life-direction questions. In a skill that extracts psychological signals and persists them, this creates stealthy collection risk because sensitive processing can occur during ordinary conversation without a specific, informed opt-in at the moment of capture.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill description says it observes conversations and captures preference/identity signals over time, but the README does not present a strong upfront privacy warning before describing this monitoring. Because the data concerns values, preferences, and identity-related inferences, lack of clear notice undermines informed consent and increases the chance users reveal sensitive information without understanding the extent of logging and profiling.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The README states that the skill auto-activates during normal chat whenever it detects vague 'decision signals,' but it does not define those triggers or require an explicit opt-in boundary. In a skill that profiles personal values and life choices from conversation, ambiguous activation materially increases the risk of collecting sensitive data unexpectedly and undermines informed consent.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The README explicitly describes silent background extraction of decision vectors from ordinary conversations without a clear warning at the point of use or explicit consent flow. Because the skill infers identity, preferences, relationships, and career intentions from free-form chat, this creates a significant privacy risk through covert profiling of highly sensitive personal data.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill logs conversation-derived signals to an Obsidian vault without a clear upfront warning or consent flow, despite handling highly personal identity and value information. Silent persistence of sensitive conversational inferences can expose users to privacy harms, unintended retention, and later disclosure through local files or synced vaults.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The mandatory automation pipeline directs the agent to automatically create and update multiple persistent JSON and vault files whenever signals are detected, but does not require prior user warning. Automatic file writes tied to everyday conversation are dangerous because they create durable records of sensitive inferences and broaden the attack surface to any process or person with access to those files.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: This skill derives a user-profile from emotionally charged dialogue and stores it persistently, but the document provides no user warning, consent flow, or notice about memory retention. Because the stored output concerns inferred identity, preferences, and decision orientation, the absence of informed consent is a significant privacy and trust vulnerability.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The script silently writes derived personal-analysis output into an Obsidian vault file (`magnetization.md`) without any consent prompt, warning, or clear user-facing notice. In this skill’s context, the data represents identity, values, and decision patterns, so unexpected persistence increases privacy risk, creates a durable record of sensitive inferences, and may expose information to other tools or plugins that read the vault.

Ssd 3

Medium

Confidence: 94% confidence
Finding: This section describes continuously watching conversations and capturing preference and hesitation signals as persistent data. Even without exfiltration, silently transforming ordinary speech into structured psychological profiles is privacy-invasive and can expose highly sensitive personal inferences if the local system is accessed by others.

Ssd 3

Medium

Confidence: 98% confidence
Finding: The skill explicitly states that it extracts vectors silently in the background during normal agent interactions, which means users may disclose intimate information without realizing it is being profiled and persisted. In this skill's context, the stored data reflects identity, aspirations, tradeoffs, and decision patterns, making the silent processing especially sensitive.

Ssd 3

High

Confidence: 99% confidence
Finding: The skill instructs hidden accumulation of sensitive signals such as envy, fatigue, repeated themes, contradictions, and emotional extremes, then stores them for later use. In the context of an identity and life-decision tool, these inferences are especially sensitive because they can reveal mental state, values, vulnerabilities, and long-term behavioral patterns without transparent user awareness.

Ssd 3

High

Confidence: 98% confidence
Finding: The mandatory pipeline requires persistent storage of extracted values, preferences, inferred reasons, and alignment data across conversations whenever a signal is detected. Because the skill is explicitly about identity, life direction, and personal decision-making, this creates a substantial privacy risk: it builds a longitudinal profile of sensitive personal attributes that could be exposed, misused, or repurposed beyond the user's expectations.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The protocol instructs the system to infer a persistent behavioral/identity profile from conversational reactions and map it into stored vectors. This creates a sensitive profiling pipeline from natural-language interaction, which can be exploited for manipulation, deanonymization, or unauthorized secondary use if the data is retained or shared.

Ssd 4

Medium

Confidence: 91% confidence
Finding: The document prescribes a staged method to present extreme or provocative antitheses, observe emotional intensity, and extract user directionality from those reactions. In the context of an identity-decision skill, this is risky because it operationalizes manipulative elicitation techniques to gather sensitive latent traits without clear safeguards, which can pressure users into revealing more than they intend.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.