Security audit

my-test-2

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed self-improvement/memory helper, but it encourages broad persistent agent memory, prompt-file promotion, cross-session transcript sharing, and always-on hooks without enough scoping or redaction guidance.

Install only if you want persistent agent memory and are comfortable reviewing what gets saved. Keep hooks project-local, avoid empty global matchers, redact secrets and private context before logging, and require explicit approval before promoting entries into prompt files or sharing anything across sessions.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The document states the hook scripts 'only output text' and 'don't modify files or run commands,' but the same guide configures them as command hooks and separately instructs users to execute one of the scripts directly. This contradiction can mislead users about trust boundaries and execution risk, causing them to enable arbitrary local scripts with the false assumption that they are non-executing and harmless.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The self-improvement skill is documented as a mechanism for capturing learnings, but this section expands it into cross-session messaging, transcript access, and sub-agent orchestration. That broadening increases the skill's operational scope and exposes communication channels that could be abused to spread injected instructions or move sensitive context between sessions beyond the user's likely expectation.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The guide instructs promotion of learnings into AGENTS.md, SOUL.md, and TOOLS.md, which are injected prompt files that can influence future agent behavior well beyond simple error logging. This creates a persistence and prompt-surface expansion risk where unvetted or adversarial 'learnings' can become durable behavioral instructions across later sessions.

Vague Triggers

Low

Confidence: 72% confidence
Finding: The script-enabled template explicitly supports executable helpers but does not require authors to document safe trigger scope, preconditions, side effects, or validation steps before running scripts. In a self-improvement skill context, where learned procedures may be reused automatically or with reduced scrutiny, vague execution guidance can increase the chance of unsafe or inappropriate command execution.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: Using an empty matcher causes the activator hook to run on every prompt, which creates an unnecessarily broad trigger surface. In a self-improvement skill, that increases the frequency of automatic script execution and context injection, raising the risk of prompt contamination, sensitive-context exposure, and accidental persistence of low-value or adversarial content.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The guide recommends user-level global activation without meaningful constraints, effectively enabling this behavior across all projects and prompts. That broad scope makes the skill more dangerous because a single configuration change affects unrelated repositories, trust zones, and potentially sensitive workflows.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The 'minimal setup' still activates on every prompt because it retains an empty matcher. Although framed as lower overhead, it preserves the core security issue of unconditional execution and repeated context injection, which is especially risky in a skill designed to capture and reuse learnings.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The Codex CLI example repeats the same empty-matcher pattern, extending overbroad activation to another agent environment. This increases risk because it encourages unconditional execution across tools, making the insecure pattern portable and more likely to be widely adopted.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The documentation presents transcript access and cross-session messaging as normal workflow features without warning that they may expose sensitive prompts, outputs, or user data across sessions. In a system already using injected workspace context, normalizing these operations without privacy guidance increases the chance of unintended disclosure or lateral movement of sensitive information.

Ssd 3

Medium

Confidence: 94% confidence
Finding: The skill encourages persisting learnings, errors, and corrections into workspace files and promoting them into broader memory files without clear minimization or sensitivity filtering. In practice, agents may store user prompts, secrets, proprietary code details, or incident context in durable locations, increasing the chance of later disclosure to other tasks, tools, or collaborators.

Ssd 3

High

Confidence: 98% confidence
Finding: The cross-session features explicitly instruct reading other sessions' transcripts and sending learnings between sessions, which creates a direct path for redistributing sensitive conversation content beyond its original context. This materially increases the blast radius of any confidential information exposed in one session and can violate isolation expectations between tasks or users.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The logging templates explicitly request full context, inputs, parameters, error output, and user context, all of which commonly contain API keys, file paths, internal URLs, personal data, and proprietary business information. Persisting these verbatim in markdown creates durable sensitive-data exposure and makes later accidental disclosure more likely.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.