Security audit

Notification Triage

Security checks across malware telemetry and agentic risk

Overview

This local notification-triage skill is not malicious, but it needs review because implementation bugs and under-disclosed persistence could cause notifications to be suppressed, marked seen, or exposed differently than users expect.

Review this skill before installing if you rely on notifications for security, billing, legal, outages, or deadlines. It stores notification excerpts locally, can silently drop items classified as ignore, and has implementation mismatches that may classify or process notifications differently from the documentation.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The manifest describes a skill that tracks seen state, but the code stores seen flags only inside batch entries and merely reads SEEN_FILE in status without ever writing to it. At the same time, it introduces a separate digest storage and digest mode not mentioned in the manifest, which expands behavior beyond the described batching/triage scope.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The comment and return logic imply rules[source] is itself the classification level, but elsewhere the code stores rules as objects like { level, created, expires, auto }. Returning level: rules[source] therefore contradicts both the documented intent and the actual rule format, causing behavior divergence.

Intent-Code Divergence

Low

Confidence: 97% confidence
Finding: The section is labeled as keyword-based classification, implying scores depend on whether the message contains listed keywords. However, the batchKeywords loop decrements score unconditionally without checking msgLower.includes(kw), so the implemented behavior contradicts the stated intent of content-based classification.

Missing User Warnings

Low

Confidence: 86% confidence
Finding: This markdown file explains that first-time classification auto-creates persistent rules and that multiple JSON files under memory/notification-triage/ are written to track batches, rules, seen state, and digests. While the behavior is documented functionally, there is no explicit warning that using the skill will modify local files and persist notification content/state, which is the kind of user-impacting behavior SQP-2 calls out for markdown descriptions.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: This markdown file describes behaviors that discard notifications (`ignore` silently dropped), mark them as seen, and clear queued items after digest generation. Because these actions can cause users or agents to lose visibility into notifications, the skill description should include an explicit warning about these consequences rather than only describing them operationally.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The digest mode prints grouped notification messages directly to terminal output, including message excerpts and source names, but unlike flushBatch there is no warning that notification content will be displayed. Because notification messages may contain sensitive or private information, this is a safety-relevant disclosure gap for a code path that outputs stored user/system data.

Persistent Context Injection

Medium

Category: Memory Poisoning
Content: 1. **Source-specific rules first** — If a rule exists for the source, use it immediately 2. **Keyword scoring** — Each urgent keyword +2, each batch keyword -1, time-sensitive +1 3. **Thresholds** — Score ≥ 3 = urgent, Score ≥ 1 = batch, else ignore 4. **Auto-rule creation** — First classification for a source saves its level as a persistent rule ---
Confidence: 80% confidence
Finding: a persistent rule

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.