Security audit

Arknights Guide

Security checks across malware telemetry and agentic risk

Overview

This is a coherent Arknights guide, but it needs Review because it recommends a remote shell installer and automatically uses persistent local profile data.

Use the package-manager install paths rather than the curl-to-bash command. Expect the skill to create and maintain a local profile at ~/.config/arknights-skill/doctor-profile.json unless ARKNIGHTS_MEMORY_DIR is set, and avoid saving UID or other account details if the machine or agent session is shared.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill declares only shell access, but its documented commands also read environment variables, search the filesystem, and persistently read/write a local JSON profile. This creates a capability transparency problem: users invoking what appears to be a Q&A skill may not realize it accesses and mutates local state, which can expose or alter personal account data without sufficiently explicit disclosure.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The advertised behavior is limited to answering Arknights questions, but the skill also performs persistent profile management, conflict tracking, deletion, migration, and garbage collection of stored user data. That mismatch undermines informed consent and can lead to unexpected collection and long-term retention of account-related information beyond what a user would reasonably expect from a game guide skill.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The manifest presents the skill as an informational guide, while the body imposes a hard gate to read a local profile before answering and mandates post-answer writes. Even though storage is local, this changes the trust model from stateless assistance to compulsory data processing, which is risky when not surfaced clearly at the top-level interface.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The skill exposes administrative capabilities over stored account memory, including listing, searching, deleting, confirming, dismissing, and garbage-collecting records. These operations exceed what is necessary for answering gameplay questions and increase the blast radius of misuse by enabling broader inspection and modification of locally stored user data.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The quickstart instructs users to execute a remote script directly with `curl | bash`, which prevents meaningful inspection of the downloaded code before execution and makes compromise of the upstream repository, hosting, or network path immediately dangerous. In the context of an agent skill, this is more dangerous because users are likely to follow setup instructions verbatim and grant the script broad access to their local environment.

Missing User Warnings

Low

Confidence: 90% confidence
Finding: The profile setup section tells users to provide account and operator details before clearly warning that this information will be persisted locally, which undermines informed consent around data storage. While the file later states the profile stays on the machine, the disclosure comes after encouraging data entry, so users may share more than they intended.

Ssd 3

Medium

Confidence: 90% confidence
Finding: The prompt mandates reading local memory and echoing a profile summary in every greeting, which can disclose stored personal or behavioral data without first establishing that the current user wants personalization or that disclosure is necessary for the task. Because this happens by default, it increases the chance of over-sharing sensitive profile attributes in contexts such as shared sessions, misrouted conversations, or minimally scoped queries.

Ssd 3

Medium

Confidence: 87% confidence
Finding: The skill repeatedly instructs the agent to persist newly provided user facts into a local profile after answering, creating a broad default data-retention behavior without clear purpose limitation, consent, or minimization. This can lead to unnecessary collection of user attributes over time, retention of sensitive data the user did not expect to be stored, and increased privacy risk if memory is later exposed or misused.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.