Security audit

Query Papers

Security checks across malware telemetry and agentic risk

Overview

The skill appears to query a Gitea knowledge base as advertised, but it requires an admin-level Gitea token and automatically saves users' search questions, so it should be reviewed before installation.

Install only if you control the target Gitea server and are comfortable giving this skill an admin-level token. Use the least-privileged token that works, keep .env out of source control with restrictive permissions, and assume user queries will be saved to log.md unless the skill is changed to disable or redact logging.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The script is presented as a read-only knowledge-base reader, but the --list path can also write user-supplied text to a log via kb.append_query_log(). This mismatch is security-relevant because callers, reviewers, or higher-level agents may invoke a supposedly read-only skill in contexts where writes, audit logging, or data retention were not consented to or expected.

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: The setup script for a seemingly unrelated skill instructs the user to supply a GITEA_ADMIN_TOKEN, which is a privileged credential and not a normal dependency for a benign paper-query setup flow. Requesting an admin token in a user-facing installer materially increases the chance of unnecessary credential exposure or later misuse, especially because the script also runs package installation and a self-test without explaining why such privilege is needed.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill explicitly requires passing --log_question so every user query is written to log.md, but the skill description does not disclose this logging behavior to the user. This creates a privacy and consent issue because users may reveal sensitive research plans, internal meeting details, or personal data without knowing their queries are being persistently stored.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The code automatically persists user-supplied query text into log.md without any evidence of consent, minimization, or redaction. Because queries can contain sensitive research topics, credentials, personal data, or proprietary information, this creates a durable privacy leak in the repository and may expose data to anyone with repo access or through later synchronization/backups.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: User queries can be persisted to log.md without any visible confirmation or warning in this code path, which creates a privacy and data-governance risk. Sensitive prompts, personal data, credentials, or research topics may be stored unexpectedly and later exposed to repository readers, backups, or other tooling.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script persists user-submitted query text to a history log associated with the user's account, but nothing in this file indicates consent, notice, minimization beyond a 100-character truncation, or filtering of sensitive content. Queries can contain personal data, secrets, or confidential research topics, so retaining them creates a privacy and data-exposure risk if logs are accessed, leaked, or reused beyond the user's expectations.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The script creates a local .env file and instructs the user to populate it with a real admin token, but provides no safeguards about file permissions, secret storage, or preventing accidental commits. This creates a realistic path to credential leakage through source control, backups, shared directories, or other local disclosure mechanisms.

Ssd 3

Medium

Confidence: 97% confidence
Finding: By default, append_query_log stores user-provided questions in plain language, which can capture secrets, personal information, unpublished research, or other sensitive operational context. Persisting this data in a repository increases exposure through history, replication, backups, and broader collaborator access, making accidental disclosure more likely.

Ssd 3

Medium

Confidence: 82% confidence
Finding: The inline help text states that providing the user's query will 'ensure the query is always recorded,' which normalizes mandatory persistence of user input. In a skill context that handles free-form natural-language queries, this increases the chance that confidential or regulated information is collected and retained beyond user expectations.

Unpinned Dependencies

Low

Category: Supply Chain
Content: requests>=2.28 python-dotenv>=1.0
Confidence: 95% confidence
Finding: requests>=2.28

Unpinned Dependencies

Low

Category: Supply Chain
Content: requests>=2.28 python-dotenv>=1.0
Confidence: 93% confidence
Finding: python-dotenv>=1.0

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High

Category: Supply Chain
Confidence: 98% confidence
Finding: requests

Known Vulnerable Dependency: python-dotenv — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low

Category: Supply Chain
Confidence: 82% confidence
Finding: python-dotenv

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.