deep-skill-finder

• Outcome: Review
• Latest audit: Aug 26, 2026 · 9:40 AM UTC
• Version: 1.2.9

Overview

This skill does what it claims, but it also installs remote skills into the local agent environment with under-disclosed tracking and weak package/path safeguards.

Review carefully before installing. Only use it when you intentionally want remote skill recommendations, avoid sensitive task text in searches, and inspect any recommended skill before installing because installation changes the local agent skills directory.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill performs environment access, local file reads/writes, and network operations without declaring permissions or presenting those capabilities transparently. This weakens user and platform trust boundaries because a skill that appears informational can actually inspect local state and modify the filesystem, including installing artifacts fetched from a remote service.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared purpose is search/recommendation, but the documented behavior extends to downloading and installing remote skills, deleting local skill directories, listing installed skills, persisting metadata, and reading config/env tokens. That mismatch is dangerous because it can mislead a user or orchestrating agent into granting trust to what seems like a harmless discovery tool when it actually has software-installation and local-state access capabilities.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The script generates and persistently stores a unique client ID under the user's home directory, then attaches it to download requests via the X-Client-Id header. For a skill whose declared purpose is finding matching skills, persistent device-level tracking is not necessary to perform the core task and creates avoidable user correlation and privacy risk across searches/downloads.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The skill metadata says this capability is for finding suitable skills, but the code downloads archives, writes files, installs scripts locally, and can uninstall existing skills. This scope expansion is dangerous because it turns a discovery tool into a code-delivery and local file modification mechanism, increasing the chance of unauthorized code introduction or destructive changes on the host.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The README states that selecting a recommended skill leads to automatic installation, but it does not clearly warn that this changes the local agent environment by adding executable skill content. For a tool specifically designed to discover and install third-party skills, that omission increases the chance users approve installation without understanding the trust and supply-chain implications.

Missing User Warnings

Low

• Confidence: 93% confidence
• Finding: The Quick Start clone command writes directly into ~/.catpaw/skills/deep-skill-finder, which is a live local agent skills directory, but the README does not explicitly call out that this is an installation into an active execution path. This can mislead users into treating the step as a harmless download rather than enabling new behavior in their agent environment.

Vague Triggers

High

• Confidence: 95% confidence
• Finding: The trigger conditions are overly broad, instructing the agent to invoke this skill whenever it is unfamiliar with a task or lacks tools. In context, this is especially risky because the skill can reach out to a remote service and lead to local installation of additional skills, creating an unbounded expansion path from ordinary user requests into external code acquisition and filesystem changes.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script sends the raw user query to a remote Meyo API endpoint for semantic search, but the code provides no user-facing notice, consent, or data-minimization controls. Because search queries may contain sensitive task details, this can leak private or proprietary information to an external service unexpectedly.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The code creates a persistent UUID in the user's home directory and reuses it as an X-Client-Id header, enabling long-term correlation of searches across sessions. Without clear disclosure or consent, this introduces a privacy risk by allowing tracking tied to a stable identifier.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.