Research Assistant

• Outcome: Review
• Latest audit: Jul 20, 2026 · 2:46 AM UTC
• Version: 1.1.0

Overview

This skill appears to be a legitimate research knowledge-base tool, but it persistently indexes potentially sensitive local and web content with limited user controls and an under-disclosed external graph dependency.

Install only if you are comfortable with a local persistent research index. Avoid using it on confidential, regulated, or PII-heavy files/pages unless you add your own retention and deletion process, and be aware that graph HTML export loads third-party JavaScript when opened.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 78% confidence
• Finding: The skill advertises no permissions while analysis indicates environment-variable capability exists in code. That mismatch can hide access to sensitive configuration or secrets from users and agents deciding whether to run the skill. In a research/indexing skill, undeclared env access is not clearly necessary and reduces transparency about what data the skill may read.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented behavior omits that the skill generates an HTML file and, when viewed, loads external JavaScript from d3js.org. This expands the trust boundary from local processing to active web content, creating privacy, supply-chain, and data-leakage risks that users would not expect from the declared description. Because the skill processes extracted knowledge from local files and URLs, rendering that graph through remote-loaded JS can expose sensitive metadata or enable tracking.

Context-Inappropriate Capability

Low

• Confidence: 94% confidence
• Finding: The graph export writes HTML that loads JavaScript from an external CDN at render time. This introduces a supply-chain and privacy risk: opening the exported graph can trigger outbound network access and execute third-party code in the browser, which is unnecessary for a local knowledge-base artifact and could expose graph contents or user context if the CDN resource is compromised or monitored.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The code redacts email addresses in the stored summary text, but then runs entity extraction on the same text and persists extracted entities, including type 'email', into the knowledge base, index, graph data, and console output paths. This creates a privacy leak and contradicts the comment, causing operators to believe emails are removed when sensitive identifiers may still be retained and surfaced elsewhere.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill stores extracted content persistently, including potentially sensitive data such as emails, URLs, and facts from documents, but the description does not prominently warn about this retention. Users may feed confidential files or pages into the tool without realizing the data will remain indexed locally for future retrieval. That creates privacy and compliance risk, especially for personal, proprietary, or regulated information.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The URL extraction workflow performs network requests to user-specified URLs, but the skill description does not clearly flag that network fetching occurs. This can surprise users in restricted environments and may be abused to contact internal or sensitive endpoints if input is not constrained. Even when intended, undisclosed network activity is a security-relevant behavior for an agent skill.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The manifest description is overly broad and does not clearly constrain the skill’s intended use, which can cause an agent or router to invoke it in contexts beyond simple research assistance. Because this skill performs web search, content aggregation, and integrates with memory-related systems, ambiguous routing increases the chance of unnecessary exposure to untrusted content, over-collection of data, or inappropriate use in sensitive workflows.

Ssd 3

Medium

• Confidence: 91% confidence
• Finding: The skill is designed to capture and retain extracted entities, relationships, emails, and URLs in a persistent, searchable knowledge base without stated sensitivity boundaries or consent checks. In the context of ingesting arbitrary files and web pages, that can accumulate sensitive personal, confidential, or regulated data far beyond the immediate task. The danger is increased because the tool's core purpose encourages broad ingestion and cross-source aggregation, making later discovery and misuse easier.

Ssd 3

Medium

• Confidence: 90% confidence
• Finding: The agent protocol explicitly instructs updating persistent memory with key findings from newly read content, which normalizes ongoing retention of user and document data beyond the original interaction. This creates a durable record that may include sensitive facts the user did not intend to store long-term. In a research assistant context, continuous memory linkage increases aggregation risk and makes accidental privacy violations more likely.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.