Security audit

sweeping-monk

Security checks across malware telemetry and agentic risk

Overview

This academic-advice skill is mostly coherent, but it also enables persistent profiling, default-on telemetry, broad upload tooling, and remote proposal-driven edits that users should review carefully before installing.

Install only if you are comfortable with an academic helper that keeps local usage/profile state and may upload method-level telemetry to the configured cloud service. Review or disable .optin and .cloud_optin before use, do not run the creator registration/proposal scripts unless you intend to manage this skill, and avoid storing creator tokens in shared workspaces.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (53)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 98% confidence
Finding: The skill declares itself as a research-advisory tool, yet its instructions enable environment access, file reads/writes, and networked behaviors through Bash, Write, Edit, and WebFetch plus explicit state-management workflows. This mismatch weakens user understanding of the real trust boundary and can hide persistence, telemetry, or remote-control behavior behind an apparently harmless advisor persona.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The documented purpose is academic strategy/advice, but the skill also performs creator registration, token handling, remote proposal management, local state persistence, and cloud telemetry upload. That description-behavior mismatch can mislead users into granting trust to a skill that actually changes files, stores identifiers, and communicates with external services.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The manifest says search and verification are delegated away, but the body authorizes direct WebFetch fact-checking and cloud proposal retrieval. This inconsistency broadens the operational scope beyond what users would expect and creates additional exfiltration and remote-content risks.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The skill is presented as an advisory methodology assistant, but it also mandates local telemetry collection and default-on cloud signal upload. For an ostensibly advisory skill, hidden persistence and remote reporting materially expand the attack surface and privacy risk.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: Default-on local usage logging is not necessary for providing research-methodology advice and creates persistent conversational metadata without prior affirmative consent. Even if only labels are claimed to be stored, the log still creates behavioral profiling and persistence risks.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: Default-on cloud telemetry upload is unjustified for the stated role and sends usage-derived signals to a remote service without explicit prior opt-in. Remote aggregation of interaction metadata can enable user profiling, covert analytics, and expansion into broader data collection over time.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The skill claims to be advisory-first and mostly non-executing, yet it includes maintainer-oriented proposal review, approval, and local file modification workflows. This gives the skill an undeclared administrative and self-modifying role that is much more dangerous than a pure advisor.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: Creator-only cloud proposal management and self-update capabilities allow remote-originated content to drive local file changes, backups, rollbacks, and version bumps. In an end-user advisory skill, that is an unnecessary remote-change channel that could be abused for supply-chain compromise or stealthy behavior drift.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The NON-mandate states the skill does not write code except for explicit validation requests, but other instructions authorize broad local edits when applying proposals. Contradictory safety boundaries reduce informed consent and make it easier for users to misunderstand when the skill may modify the system.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The file explicitly directs persistent cross-session storage of user preferences, past topics, and evaluative judgments for future reuse. Even if framed as methodology-only memory, this creates a durable user profile beyond the stated advisory scope and can expose private behavioral inferences, especially because it is automatically accumulated and reused without strong minimization controls.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The document claims it stores only methodology preferences and topic themes, but the actual contents include a real user profile, skill-level assessments, recurring weaknesses, and behavioral calibration. This mismatch is dangerous because it undermines user understanding and consent: the system is retaining more sensitive inferred data than it discloses.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The spec enables automatic cloud upload of interaction-derived telemetry to an external endpoint, which materially expands the skill's behavior beyond local research advice. Even if framed as 'method-layer tags' and anonymized, this is still external data exfiltration from user interactions and creates privacy, compliance, and trust risks when enabled by default.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: This section grants the skill an anonymous outbound telemetry capability, including a bundled public ingest URL and unauthenticated upload flow, despite the skill's stated role being research/methodology assistance. A skill with unnecessary network exfiltration capability is more dangerous because it can transmit derived user metadata off-device without meaningful friction or strong identity controls.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The privacy claim is misleading: fields such as trigger classes, reference hits, confidence, correction state, and especially later gap labels can encode information derived from a user's topic, discipline, or unmet need. That means the system may capture semantically revealing metadata while assuring users that nothing user-derived is logged, undermining informed consent and increasing re-identification or sensitive-topic inference risk.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The document first says it records only method-layer tags, but later allows discipline/method coverage-gap labels extracted from user requests. Those labels can expose sensitive topical interests or research domains, so the earlier 'zero user data' characterization is inaccurate and may cause users to unknowingly permit broader telemetry than they expect.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: This file embeds a network-connected proposal management CLI with approve/reject capabilities inside a skill described as research-methodology advisory tooling. That mismatch expands the skill's effective privilege and trust boundary: a user installing an academic helper would not reasonably expect bundled code that can contact a remote service and perform state-changing administrative actions using local credentials.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The code searches multiple local locations for bearer tokens, including a global secret store, then automatically uses any token found for remote requests. This creates credential-confusion and overreach risk: unrelated or stale creator secrets can be consumed by a skill-adjacent script, enabling unauthorized API actions or silent exfiltration of sensitive auth material to a remote endpoint configured by the package.

Description-Behavior Mismatch

High

Confidence: 83% confidence
Finding: The script stores a creator token in .deploy/cloud_open.json in plaintext and only attempts to keep it out of Git by appending .deploy/ to .gitignore. This is fragile because .gitignore is not a security boundary: the token can still be committed manually, copied into archives, or left readable to other local users/processes, exposing creator credentials if the workspace is shared or compromised.

Context-Inappropriate Capability

High

Confidence: 94% confidence
Finding: The script enumerates all skill directories under a shared base path, reads per-skill logs and state, and uploads telemetry to a remotely configured endpoint. In an academic-advisory skill, this cross-skill collection capability is broader than necessary and creates a real risk of covert data exfiltration or unauthorized aggregation if other skills' logs contain sensitive metadata.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill permits shell execution, file writes/edits, network access, and proposal application without a prominent up-front warning tied to system-changing actions. Users may engage a seemingly benign advisor without realizing it can alter local files or contact remote services.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The file describes automatic cross-session accumulation of user information and reuse in later conversations, but does not present a clear, explicit privacy warning or informed-consent flow to the user at the point of collection. Users may therefore be unaware that their interaction history is being persistently retained and used to shape future responses.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill content includes evaluative judgments and calibration notes about the user, yet the skill description does not clearly warn that such judgments may be stored across sessions. Retaining inferred assessments without transparent notice increases privacy and trust risks because users cannot meaningfully consent to profiling they are not told about.

Natural-Language Policy Violations

Medium

Confidence: 90% confidence
Finding: The file explicitly instructs that the user is a Chinese researcher and that the response must cover a localized Chinese academic context, which can override or preempt the user's actual language, region, or preference. This is risky because it may impose demographic or locale assumptions without consent, leading to mismatched guidance, exclusion of non-Chinese contexts, or inappropriate tailoring.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The file explicitly instructs users to say natural-language phrases like “看看提案” and “应用提案” to trigger automatic proposal application. Because these phrases are ordinary conversational text rather than strongly scoped commands, they can be invoked accidentally in normal discussion or echoed by untrusted content, causing unintended workflow activation and modification of the backlog.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The phrase examples "直接说『我的研究卡在 XX』或『这个实验设计有没有问题』" are broad, natural-language triggers that can easily appear in ordinary conversation about research. If the skill is auto-triggered on such common phrasing, it may activate unintentionally, causing routing errors, unexpected behavior, or disclosure of user context to the wrong skill.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.