Security audit

Coding Pronoun Prompt Resolver

Security checks across malware telemetry and agentic risk

Overview

This skill is an always-on local pronoun-ambiguity helper with disclosed local logging and no evidence of external exfiltration or destructive behavior.

Install only if you are comfortable with an always-on prompt hook that records local metadata about message scans and resolved references. Review or clear the files under ~/.claude/skills/pronoun-resolver/.claude/, and use the documented project disable file if you do not want it active for a workspace.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The script persistently records per-message analytics and also instructs the agent to maintain a correction ledger over time, which exceeds transient pronoun detection and creates a durable behavioral data store. Even though it does not write full raw prompts in this file, the combination of timestamps, flag types, and learned resolution history can reveal user behavior and conversation-derived entities, increasing privacy and retention risk.

Context-Inappropriate Capability

Medium

Confidence: 86% confidence
Finding: The logging directive at the output stage instructs the system to record resolved pronouns and corrections into a persistent ledger, which is not necessary for basic ambiguity detection. Because resolved referents may contain sensitive entities derived from conversation context, this broadens the data collected beyond the declared purpose and creates unnecessary privacy exposure.

Missing User Warnings

Low

Confidence: 89% confidence
Finding: The README discloses logging details, but the warning is buried deep in the document rather than presented prominently before install/use. Because the hook fires on every message and can emit directives that cause local persistence for flagged prompts, users may enable the skill without fully understanding that conversation-derived metadata will be stored on disk.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill installs an always-on hook that runs on every user message and persists per-message metadata to local files, but the user-facing disclosure is buried in metadata and installation details rather than presented as a clear consent notice. Even if prompts are hashed and data stays local, continuous collection can still expose sensitive usage patterns, message frequency, and resolution history without meaningful user awareness.

Natural-Language Policy Violations

Medium

Confidence: 90% confidence
Finding: The skill directs the agent to silently resolve ambiguous references in high-confidence cases, removing the user's opportunity to confirm intent before potentially impactful actions are taken. In context, this is more dangerous because the skill is specifically designed to affect interpretation of every user message, so a wrong silent resolution could cause unintended file edits, commands, or workflow changes.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The script writes user-message-derived analytics to disk silently and without any user-facing notice in the hook output. Silent persistence is risky because users may reasonably expect a lightweight detector to operate ephemerally, while the stored metadata and associated ledger can still expose communication patterns and inferred personal information.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The script forwards full eval prompts, including case prompt and conversation context, to an external LLM CLI without any disclosure or gating in this file. In an evaluation harness, this can leak sensitive test data, embedded secrets, or private conversation context to a third-party model endpoint or local toolchain configured to use one.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: tests/test_log_resolution.py:19