Lovart Skill

• Outcome: Review
• Latest audit: Jul 15, 2026 · 7:23 AM UTC
• Version: 1.0.12

Overview

This Lovart skill is a disclosed media-generation integration that uses Lovart credentials, local project/thread state, uploads, and downloads in ways that fit its stated purpose, though users should understand its persistence and external-service data flow.

Install this only if you are comfortable sending prompts, selected attachments, and generated-artifact traffic to Lovart using your Lovart API keys. Review or clear ~/.lovart/state.json if you do not want project/thread history reused, and avoid setting LOVART_INSECURE_SSL unless you knowingly accept weaker TLS protection.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill declares no explicit permissions, yet its documented behavior requires environment variable access, reading and writing local state files, and network communication. This mismatch weakens platform transparency and consent controls: users and policy systems may not realize the skill can access secrets and persist local state before invoking it.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill can read any local path provided to the upload command and exfiltrate the file contents to the remote Lovart service. That exceeds the narrowly described generation/project-management function and becomes dangerous if an upstream agent or prompt can influence the file path, because sensitive local files could be disclosed.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The skill fetches arbitrary artifact URLs and writes them to local disk, which extends it from remote API orchestration into local filesystem and network access. If a malicious or compromised service returns attacker-controlled URLs, this can enable SSRF-style fetching and unreviewed persistence of remote content on the host.

Vague Triggers

High

• Confidence: 93% confidence
• Finding: The trigger is extremely broad, covering common verbs like 'create,' 'make,' and multilingual equivalents tied to many everyday media nouns. That can cause the skill to activate in a wide range of ordinary conversations and route user requests to an external service unexpectedly, increasing the chance of unintended data sharing or unauthorized actions.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill instructs the agent to read local state from ~/.lovart/state.json and reuse projects/threads without notifying the user at the point of access. Because projects and threads represent prior conversation history and workspace context, this can silently expose historical or cross-session data to the current interaction.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: Artifact downloads are written to disk in code paths that may be triggered automatically, without any built-in disclosure or confirmation at the point of persistence. Silent local writes are risky in an agent setting because users may not realize remote content is being stored, and downstream tools may later process those files.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The skill persistently stores project and thread metadata in ~/.lovart/state.json without warning the user that conversation history and identifiers are retained locally. In shared or managed environments, this can leak sensitive workflow metadata or prompts to other local users/processes.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

**Step 1: `config --json`**
- Check local state (`~/.lovart/state.json`) for `active_project`
- If `active_project` is set → proceed to Step 2. Do NOT create a new project. Do NOT ask the user.
- If `active_project` is missing → ask the user: "Do you have an existing Lovart project ID, or should I create a new one?" **WAIT for their answer.**
- Save with: `project-add --project-id PID --name "name"`

• Confidence: 84% confidence
• Finding: Do NOT ask the user

Session Persistence

Medium

• Category: Rogue Agent

Content

**Step 1: `config --json`**
- Check local state (`~/.lovart/state.json`) for `active_project`
- If `active_project` is set → proceed to Step 2. Do NOT create a new project. Do NOT ask the user.
- If `active_project` is missing → ask the user: "Do you have an existing Lovart project ID, or should I create a new one?" **WAIT for their answer.**
- Save with: `project-add --project-id PID --name "name"`

• Confidence: 87% confidence
• Finding: create a new project. Do NOT ask the user. - If `active_project` is missing → ask the user: "Do you have an existing Lovart project ID, or should I create a new one?" **WAIT for their answer.** - Save

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/agent_skill.py:23