Security audit

Contextui

Security checks across malware telemetry and agentic risk

Overview

ContextUI appears purpose-built for local UI workflows, but it gives agents broad local-control powers with under-scoped examples and at least one concrete injection-risk pattern.

Review before installing. Only use this skill if you trust the publisher and need ContextUI to control local workflows. Keep local backends bound to 127.0.0.1, avoid wildcard CORS for real workflows, inspect scripts/exchange.sh before passing untrusted text through it, and require explicit approval before the agent clicks, types, closes tabs, stops servers, or connects external MCP servers.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The documentation instructs agents to write arbitrary JSON files into the user's `~/ContextUI/.mcp-bridge/` directory to trigger tab switching. That bypasses the narrower, audited MCP tool surface and normalizes direct filesystem-level control of an IPC/bridge mechanism, which could be repurposed for unintended actions if the bridge supports other message types or is extended later.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The example FastAPI server starts Uvicorn with host="0.0.0.0", which binds the service to all network interfaces rather than localhost only. In this skill's context, that is especially problematic because the metadata explicitly says Python backends should bind to localhost; copying this example would unintentionally expose workflow APIs to the local network and potentially any reachable network segment, depending on host firewall settings.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The FastAPI example configures `CORSMiddleware` with `allow_origins=["*"]`, `allow_methods=["*"]`, and `allow_headers=["*"]`, which permits any website or local page loaded in a browser/webview to issue cross-origin requests to the localhost service. Because the backend is intended to run locally and may expose workflow functionality or sensitive local data, broad CORS weakens the local-only trust boundary and can enable cross-site interaction with the service.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The UI automation tools can click, type, drag, and press Enter inside a live desktop app window, which can submit forms, change settings, delete data, or trigger actions with effects outside the immediate workflow. The documentation presents these as routine capabilities without an explicit warning about state-changing or externally impactful behavior, increasing the chance that an agent or user treats them as harmless inspection tools.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The workflow and server management tools include operations that can close active tabs and stop running backend processes, which may interrupt work, discard unsaved state, or cause service downtime. Because the reference describes these actions functionally but omits warnings about process termination and active-work disruption, an agent may invoke them without appreciating the operational risk.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.