Security audit

Mesh Publish

Security checks across malware telemetry and agentic risk

Overview

This memory skill is purpose-aligned in concept, but it needs Review because it persistently records conversations and can push archives to a hardcoded NAS using embedded credentials and weakened SSH checks.

Install only after removing the hardcoded NAS credentials and destination, restoring SSH host verification, and adding explicit controls for what gets logged, archived, synced, redacted, retained, and deleted. Avoid using it with secrets, tokens, private keys, personal data, or regulated information unless those safeguards are in place.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill instructs the agent to use file read/write and shell-capable tooling, yet no permissions are declared. This creates a trust gap where operators may enable a skill without understanding that it can persist data, invoke scripts, and access the environment, increasing the chance of unintended data access or execution.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 88% confidence
Finding: The documented purpose presents the skill as a memory system, but the analyzed behavior includes additional persistence, recovery, synchronization, and credential-related capabilities not clearly disclosed in the top-level description. Hidden or under-described behaviors are dangerous because they defeat informed consent and can conceal sensitive-data movement or remote exfiltration paths.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The script hardcodes NAS credentials directly in source, exposing them to anyone who can read the skill files, logs, backups, or process environment around execution. Because this script syncs a memory vault, compromise of these credentials could enable unauthorized access to potentially sensitive archived documents and broader NAS resources if the account is reused or overprivileged.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The script presents the operation as 'Safe' while disabling SSH host key verification, which permits man-in-the-middle interception or redirection to an attacker-controlled host. In this context, the misleading safety comment increases risk because operators may trust the transfer despite weakened transport authentication protecting a sensitive PDF vault.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The workflow directs logging every interaction and archiving/syncing logs, but it provides no explicit warning, consent model, or data-handling boundaries for sensitive content. In a memory skill, this makes accidental capture of secrets, personal data, and regulated information very likely.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The claim that the system preserved '30 secrets' normalizes retention of credentials or other sensitive data without any safety caveat. This is dangerous because it encourages storing high-value secrets in long-lived memory artifacts that may later be searched, copied, or synced elsewhere.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The script persists arbitrary user-provided message content directly into local memory files without any notice, consent, filtering, or sensitivity checks. In an agent-memory skill, this is dangerous because normal conversational content may include secrets, personal data, or regulated information that gets silently retained and accumulated across sessions.

Missing User Warnings

High

Confidence: 98% confidence
Finding: Using embedded NAS credentials without disclosure is a real security issue because the script silently handles authentication material that users may not expect to be present in a skill. Given the skill’s purpose as a memory/archive system, this is more dangerous than generic file sync because the synced documents may contain long-term personal, operational, or compliance-related data.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: Disabling SSH host key verification without warning removes an important protection against connecting to spoofed hosts, and users are not informed that authenticity checks are bypassed. This is especially risky for a backup/archive path because users may assume the vault is safely preserved while it could be copied to an attacker during a network interception event.

Ssd 3

High

Confidence: 98% confidence
Finding: The skill explicitly promotes verbatim persistence of daily logs into a PDF vault and NAS-backed archive. Verbatim multi-layer archival greatly increases the blast radius of any sensitive disclosure because information is duplicated across formats and locations, making deletion and access control harder.

Ssd 3

High

Confidence: 99% confidence
Finding: The instructions tell the agent to treat memory files as the source of truth and to auto-log every user message and reply on each interaction. This creates systematic collection of potentially sensitive content and can also cause stale or poisoned memory entries to influence future responses.

Ssd 3

Medium

Confidence: 93% confidence
Finding: The recovery workflow instructs the agent to read archived logs and reconstruct working memory from them after a wipe or crash. This extends the lifetime of previously shared sensitive data and can reintroduce information the user expected to be transient or deleted.

Ssd 4

Medium

Confidence: 90% confidence
Finding: The document incrementally normalizes broad memory capture, then escalates to durable archival, reboot-time restoration, and remote syncing. This pattern is risky because users and operators may not appreciate the full extent of persistence until after sensitive data has already been captured and propagated.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The usage text instructs the agent to remember and persist conversational content as the last step before replying, which encourages automatic logging of interactions by default. In this memory-oriented skill context, that increases the likelihood that sensitive or unnecessary conversation data will be stored without user awareness, making the persistence behavior more operationally dangerous rather than less.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.