Security audit

Crayfish Diary

Security checks across malware telemetry and agentic risk

Overview

This is a local diary note-taking skill that saves user-provided notes as Markdown files, with privacy caution around broad recording triggers and persistent local storage.

Install only if you are comfortable with the agent saving recorded notes as local Markdown files and summarizing them in a daily README. Use the trigger phrases deliberately, stop recording promptly, avoid secrets or regulated data unless you intend to retain it, and do not run the bundled publish script unless you understand it can commit and push files to the configured GitHub repository.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (12)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill performs file-system writes and likely reads without declaring permissions, which weakens user awareness and any permission-gating model the platform may rely on. Even though diary recording legitimately needs file access, undeclared capabilities create a trust and containment problem because the agent can modify workspace contents without explicit disclosure.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 88% confidence
Finding: The described behavior does not fully match the detected capabilities: rewriting a daily README with excerpts changes more data than a simple recorder implies, and the reported publish/git push behavior would be a major undisclosed exfiltration risk if present. Hidden or insufficiently disclosed behaviors are dangerous because users may consent to note-taking without realizing their content could be repackaged, overwritten, or transmitted elsewhere.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The trigger phrase "帮我记一下" is broad, conversational language that could be invoked unintentionally during normal interaction. In a diary-recording skill, accidental activation can cause unintended capture and storage of user content, including sensitive personal notes or nearby conversation, making this a genuine security/privacy issue in context.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The Chinese trigger phrase "帮我记一下" is broad and conversational, making accidental activation plausible during normal discussion. In a skill that persistently writes Markdown files and generates daily summaries, unintended triggering can cause silent data creation, capture of sensitive spoken content, and workspace clutter.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The English triggers "help me record", "start recording", "end recording", and "finish recording" are highly generic and likely to appear in ordinary conversation or other workflows. Because this skill creates persistent files automatically, ambiguous trigger phrases materially increase the risk of accidental activation, unintended content capture, and unauthorized file creation in the user's workspace.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The README emphasizes convenience features but does not clearly warn users that spoken content will be stored persistently as Markdown files and summarized into a daily README. This omission can mislead users about the privacy and retention consequences of using the skill, especially when diary content may include sensitive personal or work information.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger phrase "帮我记一下" is common in normal conversation and could easily be spoken unintentionally in unrelated contexts, causing the skill to begin recording without clear user intent. In a diary/memo skill, accidental activation is more dangerous because users may then dictate sensitive personal or work information that gets persisted to disk.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The README says entries are automatically stored as Markdown files and summarized daily, but it does not clearly warn that potentially sensitive notes will persist locally and may be duplicated into README summary files. This increases privacy risk because users may assume the content is ephemeral, while the summary mechanism broadens exposure by creating additional copies or condensed disclosures.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The activation rules include broad intent-based language beyond the explicit trigger phrases, which can cause unintended invocation and accidental recording of user speech. In a diary skill that captures free-form content until a stop phrase, false activations are especially risky because sensitive conversations, notes, or meeting content could be written to disk without clear user intent.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill automatically creates directories and files containing user-provided content without clearly warning that data will be persisted in the local workspace. This is dangerous because users may share sensitive personal or business information assuming transient assistance, while the skill stores it durably and organizes it for later access by others with workspace access.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The trigger phrase 'help me record' is broad natural language that can plausibly appear in ordinary conversation, making accidental or unintended activation more likely. In a diary/note-taking skill, this can cause the agent to begin capturing user content without sufficiently explicit consent or scope, which is a privacy and data-handling risk.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The trigger 'start recording' is highly generic and overlaps with common requests aimed at many assistants or device features. Because this skill records diary or memo content, ambiguous activation increases the chance of capturing sensitive speech or text under the wrong context, especially if users do not realize this specific skill has taken control.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.