Research Library

• Outcome: Pass
• Latest audit: Jul 10, 2026 · 4:50 AM UTC
• Version: 0.1.0

Overview

The skill is a coherent local research library, but users should understand it can copy, download, extract, index, export, and back up user-added materials.

Install only if you are comfortable with a local tool copying imported files into its own library, extracting searchable text and image metadata, and retaining that data in backups. Use trusted local files and URLs, avoid importing sensitive photos unless EXIF retention is acceptable, and make a fresh backup before using restore or bulk imports.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (11)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill advertises operational capabilities that imply reading local files, writing backups/exports, invoking shell commands, and potentially using network access, but it does not declare permissions or warn users about that access. This creates a trust and consent problem: users may install a seemingly local documentation tool without understanding it can access and persist sensitive project files and possibly retrieve remote content.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented purpose understates the actual behavior by omitting remote download support, export to filesystem/stdout, archive/restore behavior, project/tag management, and additional extraction/search subsystems. Security-relevant behavior hidden behind an incomplete description is dangerous because users cannot make informed trust decisions, and omitted URL ingestion materially expands the attack surface beyond a local-only library.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The add command accepts arbitrary URLs and fetches them with urllib.request.urlretrieve without any host allowlist, size limits, timeout controls, or explicit safety boundary. In a CLI that is described as local-first, this expands trust to attacker-controlled remote endpoints and can enable SSRF-like access to internal services, unexpected network egress, and ingestion of untrusted content into the local library.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The extractor intentionally converts and returns EXIF fields including GPSInfo, CameraOwnerName, BodySerialNumber, XPAuthor, and related tags as searchable text/metadata. In a local research library this can expose location history, device identifiers, and author identity to other components, indexes, backups, or UIs beyond what is necessary for basic image text extraction.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documented restore command presents restoration as a routine operation without warning that it may overwrite or replace the current local database state. In a local-first research library, users may assume restore is non-destructive, which can lead to accidental data loss, rollback to stale state, or loss of newly added documents and metadata.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: Automatic extraction from local files, PDFs, code, and images means the tool may ingest sensitive source code, document contents, and image metadata such as EXIF without an explicit warning. In a research-library context this is especially relevant because users are likely to import proprietary hardware designs and internal notes, so silent indexing and metadata capture can expose more information than expected.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: Backup and restore features inherently duplicate and overwrite local research data, but the description does not warn users about retention, storage location, or the effects of restoring older snapshots. In a local knowledge base this can lead to unintended persistence of sensitive data, confusion about deletion, or accidental rollback/overwrite of current project state.

Missing User Warnings

High

• Confidence: 93% confidence
• Finding: The restore command documentation omits a clear warning that restore can overwrite the current database state, while also documenting a forced non-interactive mode. In a local-first research library, users may run restore expecting a safe merge or rollback preview and instead destroy or replace current data, causing significant integrity and availability loss.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: Image extraction always attempts EXIF parsing and includes EXIF-derived text in the extraction output without any warning, consent gate, or sensitivity filtering. Because research-library content is likely to be indexed, cross-referenced, backed up, and surfaced in search, embedded metadata can leak private location, ownership, and authorship information unexpectedly.

Missing User Warnings

Medium

• Confidence: 78% confidence
• Finding: Search results for attachments return snippets derived from extracted document text, which can expose sensitive content from indexed files to any caller of the API. In a research-library context that stores PDFs, images, and extracted text, this increases the risk of unintended disclosure of secrets, proprietary information, or personal data during normal search operations.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The debug explanation method assembles titles, project IDs, ranking metadata, and content snippets into a human-readable output, which can leak indexed content into logs, consoles, or downstream UIs. Because this library handles local research materials and attachment text, debug-oriented disclosure is especially risky if enabled in shared environments or surfaced to untrusted users.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.