Security audit

Subagent Distiller

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent memory-distillation tool, but it broadly copies and persists private conversation history, including deleted/reset session variants, with weak scoping and privacy disclosure.

Review the scripts before installing, change the hardcoded paths to your own scoped workspace, exclude deleted/reset and sensitive sessions, avoid enabling cron until you are comfortable with ongoing capture, and inspect or delete generated chunks and task files because they may contain raw private conversation content.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill explicitly instructs users to run tools that scan historical conversations and distill them into structured knowledge, but it does not warn that this processes potentially sensitive prior chat content. That omission undermines informed consent and can lead users to expose private data, credentials, or confidential project history to automated retention workflows without realizing it.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The documentation includes destructive cleanup/reset commands that delete cursors, chunks, and state files, but it does not warn users that these actions permanently remove generated state and may trigger reprocessing of historical data. This creates a meaningful risk of accidental data loss and unintended privacy impact from re-indexing prior conversations.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The script persists generated task files containing prompt text and card summaries derived from user content without any minimization, consent, or warning. In this skill context, the source cards appear to be memory/topic files that may contain sensitive operational notes, so writing those summaries to disk expands the exposure surface and can leak data to other local processes, agents, backups, or users with workspace access.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The script copies raw session content from conversation logs into new slice files under a skill-controlled directory, increasing the number of stored copies of potentially sensitive data. In this context, the source directory appears to contain agent session transcripts, so duplicating them without minimization, access controls, retention limits, or explicit operator warning raises confidentiality and privacy risk if the workspace is accessed by other tools, users, or later processing stages.

Ssd 3

Medium

Confidence: 94% confidence
Finding: Untrusted card content is inserted directly into an LLM prompt, so any secrets, personal data, or internal instructions present in those cards may be reproduced, summarized, or propagated into downstream model outputs and task artifacts. In this skill, the cards come from a memory workspace and are specifically being consolidated and later handled by another agent, which increases the chance of prompt injection effects and unintended cross-card disclosure.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.