Security audit

whoami

Security checks across malware telemetry and agentic risk

Overview

This skill appears to provide the claimed profile-sync service, but it gives agents broad access to persistent personal profile data and includes under-scoped credential and file-deletion behavior that users should review before installing.

Install only if you intentionally want agents to read and overwrite a remote personal profile. Keep secrets and sensitive personal details out of the profile, verify the service endpoint and setup URL, protect or rotate the API key in ~/.whoamiagent, review profile changes before saving, and avoid passing existing files to --file because the helper deletes the supplied file after upload.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The update path accepts an arbitrary caller-supplied file path, reads it, and then unconditionally deletes that file. In an agent setting, this creates a dangerous file-destruction primitive unrelated to profile sync: a malicious prompt or mistaken caller could cause deletion of important local files after exfiltrating their contents to the remote profile service.

Vague Triggers

High

Confidence: 97% confidence
Finding: The description authorizes invocation whenever the agent thinks user background or preferences might help, which is overly broad and not tied to a clear user request. That can cause silent retrieval of remote identity data during ordinary tasks, expanding data exposure beyond user expectations.

Vague Triggers

High

Confidence: 98% confidence
Finding: The example normalizes automatic profile loading at conversation start for a routine coding request, without an explicit user instruction to access stored identity data. This encourages unnecessary collection and use of personal context in unrelated interactions.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The setup flow instructs downloading credential-bearing configuration from a one-time URL directly into ~/.whoamiagent, but does not provide strong warnings about secrets handling, origin validation, or local compromise risk. A malicious or mistyped URL could overwrite local config or capture credentials, and the stored file becomes a sensitive target.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill tells the agent to read a remote profile and inject it into conversation context without an explicit privacy warning or consent boundary. This can expose sensitive personal data to downstream prompts, tools, logs, or other skills that were not necessary for the user’s request.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: Automatically deleting file content after reading, without explicit warning or confirmation at the point of use, can cause unexpected data loss. In a tool intended for agent invocation, users may not realize that passing --file does more than read the file, increasing the chance of destructive outcomes from normal use or prompt-induced misuse.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The skill is specifically designed to ingest, persist, and reuse personal identity information across AI tools, which creates meaningful privacy and tracking risk. Cross-tool synchronization increases the blast radius of any misuse, compromise, or accidental disclosure of the stored profile.

Ssd 3

Medium

Confidence: 97% confidence
Finding: Automatically fetching remote identity data and injecting it into context creates a silent data flow from storage into active model inputs. That makes sensitive profile contents available to any subsequent generation step and potentially to connected tools, which is dangerous if the task does not require those details.

Ssd 3

Medium

Confidence: 94% confidence
Finding: The examples normalize remembering and remotely storing new personal information mentioned in chat, which can condition agents to persist sensitive data by default. Users may disclose information conversationally without realizing it will be stored for future use across systems.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: references/profile_format.md:46