Security audit

Agent Context KB

Security checks across malware telemetry and agentic risk

Overview

The skill mostly manages a project knowledge base, but its stats tooling reads local agent conversation logs by default and stores derived activity metadata, so it should be reviewed before installation.

Install only if you are comfortable with a KB tool that can modify `.agent-kb/`, create a nested KB git repo, run local git commands, and, when `stats` is used without opt-out flags, read local Claude/Codex transcript stores to derive KB usage metrics. Prefer running `stats --no-backfill` unless you intentionally want transcript-based analytics.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill instructs use of a Python script that can read files, write files, and invoke shell-like operations, but it declares no permissions or equivalent warning surface. That creates a transparency and least-privilege problem: users or orchestrators may authorize the skill under the assumption it is documentation-only, while it can actually modify repository state and access local data.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documented purpose presents the skill as repository-local KB management, but the observed behavior includes scanning local Claude/Codex transcript directories outside the repo, backfilling events into `.agent-kb/.log/events.jsonl`, analytics generation, protocol-compliance analysis, and git-history inspection. This mismatch is dangerous because it expands data collection beyond user expectations, potentially exposing sensitive local conversation history and metadata and writing derived telemetry into the project.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The `stats` workflow reaches outside the repository and scans local Claude/Codex transcript directories, then backfills derived session activity into `.agent-kb/.log/events.jsonl`. That exceeds the stated KB-management scope and creates a privacy-sensitive data collection path from unrelated local agent history into project-local storage.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The transcript backfill/cache logic implements local surveillance-style analytics by enumerating sessions, parsing transcript files, and persisting read-derived metadata. Even if it stores only derived fields, it still correlates user activity across sessions without a narrowly justified need for core KB maintenance.

Context-Inappropriate Capability

Medium

Confidence: 81% confidence
Finding: The script is part of an agent skill but reads local Claude/Codex transcript stores outside the repository to analyze session behavior. In the skill context, that expands access beyond managing `.agent-kb/` and can expose sensitive prompts, code snippets, secrets, or personal data from unrelated sessions, especially if the skill is invoked without clear user understanding.

Description-Behavior Mismatch

Medium

Confidence: 80% confidence
Finding: The smoke test reaches into compliance-analyzer and eval-runner workflows that are outside the stated purpose of managing a repository KB. That scope expansion is dangerous because it normalizes a broader execution and data-processing surface inside a skill that users may trust as narrowly scoped, increasing the chance of unintended access to transcripts, repositories, or evaluation infrastructure.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: These tests exercise transcript/session backfill and compliance-analysis behavior, indicating the skill can inspect local Claude/Codex session logs and derive behavior metrics from them. In a KB-management context this is more dangerous because transcript parsing can expose sensitive prompts, file paths, commands, and workflow metadata that are not necessary for ordinary KB maintenance, creating a privacy and surveillance risk if misused.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: This section adds general eval-bundle execution and parser logic unrelated to core KB upkeep, materially enlarging the skill's capability surface. In a supposedly KB-focused skill, bundled evaluation execution can touch external repos, pinned commits, raw artifacts, and model-run infrastructure, increasing the blast radius of mistakes or abuse beyond user expectations.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The code recursively scans local Claude and Codex transcript directories and reads transcript contents to infer KB access, even though those transcripts can contain unrelated prompts, repository data, secrets, and sensitive user activity outside the current KB files. Because this collection operates over broad local transcript stores rather than narrowly scoped repository artifacts, it creates a privacy and data-minimization issue and expands the skill's access to cross-session local data.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The implementation correlates activity across multiple agent harnesses by parsing both Claude and Codex transcript formats, effectively performing cross-harness monitoring of local agent behavior. In a KB-management skill, that is broader than necessary for routine knowledge-base operations and can expose sensitive workflow history from other tools and sessions, increasing the risk of unintended surveillance and overcollection.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The default prompt tells the model to use this skill whenever the user is working with project knowledge, but it does not define clear boundaries or approval conditions for when the skill should activate. In an agent setting, broad trigger language can cause over-invocation on loosely related requests, increasing the chance of unintended reads or writes to repository memory and creating a larger prompt-injection and data-integrity attack surface.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: Transcript backfill occurs as part of stats behavior and writes derived session/file access records into local logs and cache files without a strong operation-site warning or affirmative consent. Because transcript directories can contain sensitive interaction history, silent or weakly disclosed collection materially increases privacy risk.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The code defaults to accessing local transcript directories containing historical session data without any explicit warning in the file or runtime confirmation. For an agent skill, this is dangerous because users may expect KB maintenance only, while the tool silently inspects broader local data that may contain confidential content from unrelated work.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: The code reads local transcript files silently, with no user-facing warning, consent flow, or obvious disclosure at the point of collection. Even if the goal is operationally benign, hidden access to transcripts undermines user expectations and can expose sensitive conversational or code data without informed approval.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The transcript backfill feature creates a retention path for transcript-derived metadata by storing sessions, file reads, timestamps, and cache state under `.agent-kb/.log/`. Even without full transcript contents, this preserves interaction metadata that can reveal user behavior and project access patterns over time.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/smoke_test.py:71