Security audit

glass2claw

Security checks across malware telemetry and agentic risk

Overview

The skill is a disclosed photo-routing workflow, but its manifest and sample agent instructions can lead to external photo posting and durable database writes with uneven confirmation controls.

Review this skill before installing or adapting it. Keep automatic routing disabled unless you have named and allowlisted the exact destination, require confirmation before any Discord post or database write, and be careful with photos containing people, locations, business cards, or bystanders.

SkillSpector

By NVIDIA

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The sample `sessions_send` payload explicitly instructs the downstream destination to both analyze the image and log it to a database, which goes beyond the stated skill purpose of user-confirmed photo routing to approved destinations. This creates a documented path for secondary processing and persistence of potentially sensitive image data, increasing privacy and scope-creep risk even if the top-level router itself does not store the image.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The protocol says not to describe or analyze the image, but then requires immediate intent classification into categories such as wine, tea, cigar, or contacts. That contradiction encourages the agent to perform image-content inference while presenting the behavior as if no analysis is occurring, which can bypass user expectations and cause misrouting or inadvertent handling of sensitive images such as faces or business cards.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The sample persona expands a nominal photo-routing skill into autonomous persistence by directing the agent to write structured entries to a user database. That creates cross-tool side effects and durable storage of image-derived data without an explicit per-action consent gate, which is risky even if the broader skill metadata mentions approved destinations and confirmation requirements.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The documentation presents the skill as a routing mechanism, but the embedded persona directs the agent to analyze content, post it into a channel, and persist derived records. This mismatch increases the chance that deployers underestimate the skill’s authority and privacy impact, leading to unintended automation and broader data handling than expected.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The manifest description promises 'auto-routes your photo into the right database' and 'Hands-free life logging,' which directly conflicts with the stated safety constraints requiring explicit opt-in, allowlisted destinations, and confirmation before cross-session forwarding or persistent writes. In a skill that handles photos from wearable cameras and routes them through WhatsApp into databases, this wording signals autonomous collection and persistence of sensitive images, increasing the risk of unauthorized forwarding, retention, and privacy violations.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The persona instructs reposting user images to a Discord channel but does not embed any warning or consent check about sharing captured photos with another audience or service. Photos can contain sensitive personal, location, or bystander information, so forwarding them without a clear confirmation step materially increases privacy risk.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The sample directs the agent to create structured entries in a user database without warning that this is a persistent data modification. Persistent writes can create inaccurate records, store sensitive data long term, and be difficult to audit or undo if the image is misread or the routing was accidental.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.