Bytesagain Study Plan

Security checks across malware telemetry and agentic risk

Overview

This is a local study-planning tool that stores user-entered tasks on the same machine, with no evidence of network transfer, credential access, or hidden destructive behavior.

Before installing, know that tasks and command history are saved locally, normally under ~/.local/share/study-plan unless overridden. Avoid putting highly sensitive personal details into tasks on shared or backed-up machines, and use the help command to confirm supported commands.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The skill description and usage text are broadly framed around common planning activities like adding tasks, planning reviews, tracking progress, and prioritizing subjects without clear boundaries on when the skill should activate. In an agent environment, this can cause overbroad invocation on ordinary productivity requests, leading to unintended skill execution, confusing behavior, or unnecessary access to user task-planning context.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script persistently records user-supplied task content and command history to files under a data directory without any clear user-facing disclosure or consent. In a study-planning context, tasks may contain sensitive academic, personal schedule, or reminder details, so silent retention increases privacy risk and can expose data to other local users or backups.

VirusTotal

67/67 vendors flagged this skill as clean.

View on VirusTotal