Issuefinder Tool

• Outcome: Review
• Latest audit: May 29, 2026 · 9:22 PM UTC
• Version: 1.0.0

Overview

This vehicle log tool mostly does what it claims, but it also auto-downloads and runs replacement code in a persistent user directory without integrity checks or clear approval.

Review before installing. Use it only if you trust the configured IssueFinder server both as a data processor and as a code publisher. Prefer running with --skip-version-check, inspect or remove ~/.issuefinder/issuefinder-tool.py before use, limit VIN/time queries to what you need, and store downloaded logs in a restricted directory.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

os.system() or os exec-family call

High

• Category: Dangerous Code Execution

Content

print_status("Restarting with new version...")
        
        # Re-execute with the new version
        os.execv(sys.executable, [sys.executable, new_tool_path] + sys.argv[1:])
        
    except Exception as e:
        if verbose:

• Confidence: 99% confidence
• Finding: os.execv(sys.executable, [sys.executable, new_tool_path] + sys.argv[1:])

os.system() or os exec-family call

High

• Category: Dangerous Code Execution

Content

# or if it's different from current script
        try:
            # Re-execute with the updated version
            os.execv(sys.executable, [sys.executable, updated_tool] + sys.argv[1:])
        except Exception:
            pass  # If re-execution fails, continue with current version

• Confidence: 98% confidence
• Finding: os.execv(sys.executable, [sys.executable, updated_tool] + sys.argv[1:])

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The skill is described as a log download/parsing tool, yet it also implements a hidden self-update mechanism that downloads replacement code and executes it. This undeclared code-loading capability materially increases risk because a tool expected to process logs now also acts as a remote software installer/executor.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The skill instructs users to send VIN-linked timestamps and retrieve/analyze cloud vehicle logs through IssueFinder APIs, but it does not clearly warn that operational and potentially sensitive telemetry will be transmitted to remote infrastructure. In a vehicle-log context, this omission increases the risk of inadvertent disclosure of sensitive fleet, device, or user data.

Missing User Warnings

Low

• Confidence: 78% confidence
• Finding: The documentation strongly recommends wrapper commands that automatically store downloaded and processed logs into predictable local directories, but it does not warn that these logs may contain sensitive vehicle, system, or personal data. Automatic persistence to shared or insecure paths can expose data to other local users, backups, or unintended retention.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The documentation describes automatic cloud log download, analysis, and local storage without clearly warning that vehicle logs may contain sensitive data and may be persisted on disk. In a vehicle diagnostics context, this increases privacy and data-handling risk because users may unknowingly store identifiers, crash data, or operational telemetry in predictable locations.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The updater silently downloads, replaces, and re-executes the script without prominently warning the user that executable code will be fetched and run. In combination with the remote-code-loading design, this lack of disclosure makes unsafe execution more likely and reduces the chance users notice tampering.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.