Security audit

smart-files

Security checks across malware telemetry and agentic risk

Overview

This local file-management skill is not clearly malicious, but its install metadata, documentation, and code disagree about external file access, watch-mode persistence, and possible file modification behavior.

Install only if you are comfortable with a local tool that reads file contents, may be directed outside the workspace with --force, and is intended to retain file metadata in a journal. Review the manifest/documentation mismatch first, and avoid using it on sensitive directories until the --info scoping, watch-mode journal controls, and write-scope documentation are corrected.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The skill is described narrowly as secure file search/dedup/organize/rename, but the documentation also reveals broader surveillance-like capabilities: long-running watch mode, persistent journaling of file paths/hashes/timestamps/events, metadata inspection, and cleanup/status inventory. This mismatch can mislead users and reviewers about the true data collection and persistence scope, increasing the chance of over-trust and unintended sensitive filesystem monitoring, especially when combined with --force and fs.external_path.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The README gives contradictory guidance about disabling journal persistence: it says deleting the file before watch mode disables disk writes, then immediately says the code will recreate it. In a tool that scans potentially sensitive paths and persists file paths, hashes, sizes, and timestamps, misleading operators into believing persistence is disabled can cause unintended metadata retention and privacy exposure.

Scope Creep

High

Confidence: 97% confidence
Finding: The manifest declares write access only for a journal file, while the skill metadata and description indicate organize/rename behavior using copy+unlink and persistent journaling. This understates the real write scope, which can mislead reviewers and users into granting broader file-modification capability than the manifest suggests.

Scope Creep

Medium

Confidence: 92% confidence
Finding: The skill description advertises a watch mode with continuous monitoring and persistent journaling, but the manifest does not declare a corresponding persistent filesystem watch capability. This creates a transparency gap: users may approve the skill without understanding that it can continuously observe file changes over time.

Scope Creep

High

Confidence: 98% confidence
Finding: The description states that --force can override the workspace boundary and scan external directories, but the manifest does not declare external-path access. In a file-management skill, undeclared out-of-workspace access is especially dangerous because it can expose or process sensitive files beyond the expected trust boundary.

Scope Creep

High

Confidence: 98% confidence
Finding: The --info mode accepts an arbitrary filepath and passes it directly to fs.statSync/readSafe without applying resolveDir-style workspace scoping or requiring --force. This allows reading metadata and textual content-derived information from files outside the workspace boundary, undermining the permission model and enabling unintended access to sensitive local files.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: Watch mode persistently logs file paths, hashes, timestamps, and change events to a journal, but invocation-time messaging does not clearly foreground that persistent recording will occur before monitoring starts. In a file-management skill with recursive read/watch permissions, silent persistence increases privacy risk because sensitive filenames and activity history may be retained unexpectedly.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.