Security audit

Plaud Unofficial Skill

Security checks across malware telemetry and agentic risk

Overview

The skill appears purpose-built for Plaud access, but it asks users to store a long-lived Plaud session token locally and handle private recordings without enough safeguards.

Review before installing. Use this only if you are comfortable giving a local helper access to your Plaud recordings, transcripts, summaries, and tags. Store the `.env` file privately, do not commit or share it, avoid passing tokens on the command line, rotate or revoke the Plaud session if exposed, and download bulk recordings only to a protected location you intend to keep.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill clearly instructs use of environment-based credentials and network access to Plaud services, but the manifest does not declare permissions. This creates a transparency and governance gap: users or tooling may not realize the skill handles secrets and makes external requests, increasing the chance of unsafe execution or inadequate review.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill instructs users to extract a bearer token from browser localStorage and place it into a plaintext .env file, but does not warn that this token grants direct API access to private recordings and transcripts. Storing such a credential in an unprotected file increases the risk of accidental disclosure through backups, shell history, file syncing, local compromise, or repository commits.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill promotes downloading recordings, transcripts, and batch exports to local disk without warning that these files may contain sensitive personal, business, or regulated audio data. Writing them to arbitrary paths can leave confidential content exposed to other local users, backups, sync services, or insecure storage locations.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The script instructs users to retrieve an authentication token directly from browser localStorage and paste it into the tool, but gives no warning that this is a sensitive bearer credential granting account access. This increases the chance of accidental exposure through shell history, screenshots, logs, or insecure storage, especially because the skill handles recordings and related sensitive user data.

Unpinned Dependencies

Low

Category: Supply Chain
Content: requests>=2.28.0 python-dotenv>=1.0.0
Confidence: 93% confidence
Finding: requests>=2.28.0

Unpinned Dependencies

Low

Category: Supply Chain
Content: requests>=2.28.0 python-dotenv>=1.0.0
Confidence: 93% confidence
Finding: python-dotenv>=1.0.0

Known Vulnerable Dependency: requests==2.28.0 — 7 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +4 more

High

Category: Supply Chain
Confidence: 96% confidence
Finding: requests==2.28.0

Known Vulnerable Dependency: python-dotenv==1.0.0 — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low

Category: Supply Chain
Confidence: 85% confidence
Finding: python-dotenv==1.0.0

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.