Security audit

mia

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent memory and planning helper, but users should understand that it can store task history locally and send planning prompts to configured model APIs.

Install only if you want persistent task memory. Avoid storing secrets, personal data, or confidential workflows in questions, plans, execution traces, or feedback. Keep the memory and feedback files in a private location, review or delete them periodically, and use local mode or a trusted HTTPS model endpoint with a dedicated API key for sensitive work.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The planner reads an API key from the environment and supports sending prompts to a fully user-configurable endpoint via MIA_PLANNER_URL. That creates a real data-exfiltration path because questions and historical plans may contain sensitive user or system data, and the custom URL is not constrained to trusted hosts or HTTPS.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill documentation describes an API mode for the Planner, including custom endpoint support and API key usage, but does not warn users that their prompts/questions may be transmitted to external services. In an agent skill, this omission is security-relevant because users may unknowingly send sensitive data to third-party endpoints and expose secrets through misconfiguration or trust assumptions.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The Memory and Feedback sections show that questions, plans, answers, and execution artifacts are stored in local JSONL files, but the skill description does not clearly warn users about this persistence. This can lead to unintended retention of sensitive or proprietary data on disk, where it may be readable by other local users, included in backups, or committed to source control.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill persists user-supplied memory records to disk via the `store` flow and does not provide any notice, consent mechanism, retention policy, or data-minimization control. In a memory assistant, those records may contain prompts, task history, or sensitive personal/business data, so silent persistence increases privacy and data-handling risk even if the code is not overtly malicious.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill explicitly documents storage of feedback records containing question and answer content, but it does not disclose retention behavior, privacy implications, or handling of potentially sensitive user data. Because user prompts and answers may contain personal, confidential, or regulated information, silent persistence can create avoidable privacy and compliance risk even if the feature is not malicious.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill explicitly supports storing question, plan, and execution trajectories to a local file, but does not warn that these records may contain sensitive prompts, reasoning traces, operational steps, or user data. In practice, this can lead to unintentional persistence of confidential information on disk, increasing the risk of later disclosure through file access, backups, or log collection.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The script persistently stores user-supplied records to a JSONL file on disk, including arbitrary entry content and timestamps, without any notice, consent flow, retention policy, size limits, or protection of potentially sensitive data. In a memory/assistant context this is more dangerous because questions, execution traces, and steps may contain secrets, personal data, or internal workflow details that can be retained and later exposed through local file access or accidental reuse.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The code posts the full prompt, including the current question and optional reference plan, to a remote endpoint whenever API mode is used. There is no in-band disclosure, consent, redaction, or classification of sensitive content, so private information can be transmitted off-host unexpectedly.

VirusTotal

67/67 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.