SherpaMind

• Outcome: Review
• Latest audit: May 29, 2026 · 9:29 PM UTC
• Version: 0.1.7

Overview

SherpaMind is a coherent SherpaDesk support-data tool, but it needs review because it stores broad ticket data locally, can run persistently, and can export or publish sensitive derived artifacts without strong consent gates.

Install only if you trust this publisher with SherpaDesk API access and are comfortable keeping local plaintext copies of ticket history, logs, contact details, generated markdown, and export files. Keep the workspace private, review .SherpaMind/public and export destinations, avoid sharing doctor/bootstrap output, require explicit approval before any GitHub issue posting, and enable the background service only when unattended sync/indexing is intended.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (23)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 97% confidence
• Finding: The skill advertises significant capabilities—environment access, file read/write, shell execution, and network use—yet does not declare permissions. This undermines least-privilege and informed-consent controls, especially because the skill stages secrets locally, installs dependencies from PyPI, and can invoke system/service management commands. In this context, the missing declaration materially increases the risk of unreviewed secret access, filesystem changes, and command execution.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The skill documentation explicitly directs installation and management of a long-lived user-level systemd service, which expands the skill from SherpaDesk data access into persistent host automation. Even though it runs as the current user rather than root, persistence, auto-start behavior, and background execution materially increase the attack surface and make misuse or unintended side effects harder for users to notice or control.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The documented commands include starting, stopping, installing, uninstalling services and cleaning up cron jobs, which grants host automation and modification capabilities beyond simple support-data querying. Those controls can alter a user's local environment and persistence mechanisms, so if invoked unexpectedly or abused they could disable existing jobs, establish stealthier background behavior, or create operational disruption.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: This function deletes local OpenClaw cron jobs, which is a destructive system-management action outside the core SherpaDesk query and analysis purpose. In the context of a data-analysis skill, hidden or implicit removal of scheduled jobs can disrupt background operations, surprise users, and create unintended denial of service against local automation.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: Invoking a local CLI to enumerate and manage cron jobs grants the skill a host-automation capability unrelated to ordinary SherpaDesk reporting. That expanded authority increases risk because a support-analysis skill can now affect local scheduler state, making misuse or unintended execution more damaging than its advertised purpose suggests.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: This code materializes full-ticket documents that include extensive sensitive data such as user names, emails, phone numbers, internal notes, workpad content, recent logs, attachment metadata, and operational details, then stores them in local document tables for later retrieval. In a support-analysis skill, aggregating and persisting broad PII and internal ticket content beyond the minimum needed for query answering increases exposure, retention, and secondary-use risk if the workspace, DB, or downstream indexing layer is accessed by other tools or users.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The export functions allow writing full ticket documents and chunks to an arbitrary filesystem path, producing newline-delimited JSON files that may contain rich PII, internal notes, and support-history data. This creates an easy exfiltration and oversharing path because sensitive ticket data can be copied outside the managed database/runtime store into less protected locations without any apparent restriction, sanitization, or approval flow.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The export function serializes full chunk text plus a very large set of metadata fields, including user email, phone, technician email, notes, workpad content, participant domains, and other sensitive ticket context, into a newline-delimited file on disk. In a SherpaDesk support environment this creates a bulk local data-exfiltration surface: anyone with filesystem access, backup access, or a downstream embedding pipeline can obtain far more customer/support data than is needed for ordinary analytics, increasing privacy, confidentiality, and compliance risk.

Context-Inappropriate Capability

Medium

• Confidence: 81% confidence
• Finding: The manifest/export entrypoint exposes a convenient bulk corpus-export capability that can dump retrieval-ready ticket data to arbitrary output paths. Even if intended for embeddings or diagnostics, this materially broadens the skill from live query/analysis into mass extraction of support records, which is dangerous in a system handling customer tickets and internal notes.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The trigger text is very broad and includes catch-all language such as open-ended natural-language questions about SherpaDesk data and similar support-operations analysis. That can cause the skill to activate for loosely related prompts, increasing the chance that a high-capability skill is invoked when unnecessary, with access to credentials, local state, networked backends, and shell-driven setup paths.

Missing User Warnings

Medium

• Confidence: 72% confidence
• Finding: The bootstrap script performs package installation and upgrades without any explicit warning, prompt, or dry-run mode. In this skill context, that is more sensitive because bootstrap may reach the network, modify the local Python environment under workspace runtime state, and execute package installation logic that users may not expect from a data-analysis skill.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: `remove_managed_cron_jobs()` performs irreversible deletion of scheduled tasks without any confirmation, dry-run mode, or visible warning in this file. If triggered accidentally or by a higher-level prompt flow, it can silently remove operational jobs and break expected background behavior on the user's machine.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The `workspace-layout` command prints detailed paths for the workspace, config, secrets, database, logs, and service state, including the API key and API user file locations. While it does not disclose secret values, exposing exact secret-storage and runtime-state locations lowers the effort for a local attacker, malicious plugin, or log-harvesting process to target sensitive files and operational artifacts.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The `doctor` command emits sensitive operational metadata, including secret file paths, database and service artifact locations, and booleans indicating whether API credentials and org/instance configuration are present. This information can meaningfully aid reconnaissance by revealing where secrets live and whether the environment is configured for live access, especially if command output is captured in CI logs, chat transcripts, or support bundles.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The `bootstrap-audit` command exposes runtime paths, secret-storage locations, and credential presence in both JSON and summary output, effectively producing an onboarding map of the local sensitive environment. In the context of this skill, which manages SherpaDesk credentials and local runtime state under `.SherpaMind/`, this increases risk because the tool is explicitly designed to handle live support-system access and may be run in shared shells or captured output channels.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: These export routines write sensitive ticket content to disk with no visible warning, consent checkpoint, or contextual disclosure, increasing the likelihood of accidental data leakage by legitimate operators. Given the skill's SherpaDesk support context, exported records can include customer and technician identifiers, communications, phone numbers, and internal workflow details, so silent export behavior materially raises privacy and compliance risk.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: This code exports extensive SherpaDesk-derived data into workspace-local markdown files under a public/docs-style path, including ticket subjects, accounts, technicians, recent logs, attachment metadata, and operational summaries, but there is no consent gate, warning, redaction layer, or access-control check in this code path. In the context of a support-desk skill handling potentially sensitive customer and internal support data, this creates a real data exposure risk because downstream tools, other local users/processes, indexing systems, or accidental commits can ingest these artifacts as if they were safe-to-share public content.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This file implements an infinite background service loop that continuously runs tasks every 30 seconds and writes runtime state and logs to disk. In the context of this skill, those tasks also trigger ticket sync, enrichment, snapshot generation, and vector index refresh operations, so the behavior is persistent and recurring rather than a one-shot user action; without clear user-facing consent/disclosure at the point of activation, this creates a meaningful transparency and unauthorized-background-processing risk.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This code writes extensive user, ticket, and note data to disk silently, with no built-in notice, consent, or disclosure mechanism despite handling clearly sensitive support information. In this skill context, lack of transparency is especially risky because operators may believe they are running analytics queries while the system persists a reusable local corpus containing customer and internal support content.

Missing User Warnings

Low

• Confidence: 72% confidence
• Finding: The manifest export writes aggregate retrieval-readiness and metadata coverage information to disk without disclosure. While less severe than raw content export, these summaries can still reveal internal account names, technicians, categories, operational gaps, and dataset characteristics that may be sensitive in a support environment.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: The code persists watcher state to a local JSON file, and that state includes ticket-derived metadata such as subject, account_name, status, and timestamps. In a SherpaDesk support context this can expose potentially sensitive customer or operational information to other local users, backups, or logs if the workspace is not adequately protected, even though the behavior appears to be for legitimate caching/state tracking rather than malicious collection.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The test explicitly verifies that exported embedding metadata contains direct personal/contact data such as technician_email, user_phone, user_created_email, and user_email. In a SherpaDesk analytics skill, this is risky because tests can normalize and lock in PII export behavior, increasing the chance that production vector export/manifests include sensitive data in files, logs, embeddings, or downstream indexing systems without minimization or consent controls.

Session Persistence

Medium

• Category: Rogue Agent

Content

Default expectation on Linux is that `setup` initializes the DB, cleans up any old SherpaMind cron jobs, and can generate an initial public snapshot. Treat user-level `systemd` installation as a later, explicit operator choice rather than part of the earliest bootstrap steps.

If service installation fails because the target host lacks usable `systemctl --user`, continue the bootstrap/config/seed flow anyway, report the service limitation clearly, and use `python3 scripts/run.py service-run-once` or `python3 scripts/run.py service-run` as the fallback operational mode instead of pretending the service installed.

If install/runtime/use issues or meaningful feature gaps are discovered while operating SherpaMind, check <https://github.com/kklouzal/SherpaMind/issues>. If a matching issue exists, add supporting detail; otherwise open a new issue with clear reproduction/context. Keep issue content anonymized and public-safe.

• Confidence: 82% confidence
• Finding: systemctl --user`, continue the bootstrap/config/seed flow anyway, report the service limitation clearly, and use `python3 scripts/run.py service-run-once` or `python3 scripts/run.py service-run` as t

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.