Nex Life Logger

• Outcome: Review
• Latest audit: May 28, 2026 · 6:28 AM UTC
• Version: 1.1.0

Overview

This is a real life-logging tool, but it starts continuous activity monitoring and understates some sensitive data and network behavior.

Install only if you intentionally want a background service to continuously record browser history, foreground windows, searches, and YouTube activity. Treat the database and exports as highly sensitive, disable or stop the service when you do not want tracking, avoid remote summaries unless you trust the configured provider, and prefer environment-variable API keys until plaintext config storage is fixed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (22)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def _win_store(key):
    import subprocess
    subprocess.run(["cmdkey", "/delete:" + SERVICE_NAME], capture_output=True)
    result = subprocess.run(
        ["cmdkey", "/generic:" + SERVICE_NAME, "/user:" + ACCOUNT_NAME, "/pass:" + key],
        capture_output=True, text=True,
    )

• Confidence: 90% confidence
• Finding: The API key is passed to `cmdkey` as a command-line argument (`/pass:<key>`). On Windows, command-line arguments may be exposed to local users, process inspection tools, logs, crash reports, or EDR telemetry, which can leak the secret during storage even if it is later kept in the credential manager.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill advertises substantial capabilities—shell execution, file access, environment interaction, and network use—yet declares no permissions or equivalent upfront capability warnings. This can mislead users and orchestration systems about the real trust boundary, especially because setup and service-management commands create persistent local monitoring and may access sensitive personal data.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The description emphasizes local-only tracking and explicit LLM configuration, but the documented behavior also includes background collection, transcript fetching from YouTube, data export, keyword extraction, and AI-generated summaries. This mismatch matters because users may consent under a narrower privacy model than the skill actually implements, leading to unanticipated collection, retention, and transmission of highly sensitive activity data.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The collector fetches YouTube transcripts for visited videos, which goes beyond merely logging that a video was watched. In context, the skill claims local-only activity tracking, so enriching browsing history with transcript content materially increases sensitive-data collection and can expose viewing behavior to external services.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The imported transcript retrieval capability introduces network-based enrichment into a component presented as a local headless collector. That mismatch is dangerous because users may reasonably expect browser-derived data to stay on-device, while video identifiers may be transmitted off-host during transcript fetching.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: This code transmits sensitive local activity logs and model inputs to a configured external LLM endpoint via `client.chat.completions.create(...)`. Even though the provider must be explicitly configured, the file content includes browsing activity, app focus data, search queries, and potentially transcript content, which contradicts the stated expectation that activity data remains local unless very clearly disclosed.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The system prompt asserts that private chats, politics, news, and entertainment have already been filtered out, but this module itself does not enforce those guarantees before forwarding data for summarization. If upstream filtering is absent, incomplete, or regresses, sensitive or unexpected content may be sent to the LLM under false assumptions, increasing privacy exposure and weakening defense in depth.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The skill description says activity data stays on the user's machine, but the CLI supports configuring remote providers and generating summaries through external LLM endpoints. That mismatch can mislead users into sending highly sensitive browsing and activity history off-device without realizing the privacy implications.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The installer creates and starts a persistent background collector via systemd/launchd, which materially changes the user's system behavior beyond a one-time setup action. While this aligns with the product's logging purpose, auto-enabling continuous collection without an explicit opt-in at install time is security-relevant because it establishes ongoing monitoring and persistence.

Missing User Warnings

High

• Confidence: 93% confidence
• Finding: The README explicitly advertises silent collection of browser history, active windows, and YouTube transcripts, but it does not present an equally prominent warning about the scope and sensitivity of this monitoring at the point of description. Because this skill is designed to capture highly sensitive behavioral data, understating the privacy implications can lead users to install or run it without fully informed consent, increasing the risk of surveillance, sensitive data exposure, and misuse by an agent or local adversary.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger phrases are broad enough to match common requests like 'what was I doing' or 'last week,' which could cause an agent to invoke a highly sensitive surveillance-oriented skill in ordinary conversation. In this context, over-triggering is dangerous because the skill exposes private browsing history, app focus, and transcripts, potentially revealing personal or confidential information without sufficiently specific user intent.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill presents itself as an activity tracker but does not put a strong, immediate warning upfront that it continuously monitors browser history, active windows, and YouTube activity via a background collector. Because this is unusually privacy-invasive functionality, insufficient disclosure increases the chance that users enable or query it without fully understanding the scope of collection and retention.

Missing User Warnings

High

• Confidence: 87% confidence
• Finding: This file implements continuous background collection of browser history, active window metadata, and YouTube-derived content without any visible consent, notice, or gating in the collector itself. In a surveillance-style data collection context, silent operation significantly increases privacy and misuse risk even if data is stored locally.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: Transcript retrieval is triggered from visited YouTube URLs and can disclose browsing-derived video identifiers to an external service without any warning at this point in the flow. That creates an unexpected outbound data path from local history into third-party processing.

Missing User Warnings

High

• Confidence: 90% confidence
• Finding: The code actively inspects the foreground application and window title across platforms, which can capture highly sensitive contextual information such as documents, private chats, or internal tools. In a background service, doing this without explicit user-facing notice or strong default exclusions creates substantial privacy and insider-risk exposure.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: Collected activities are persisted locally via insert_activities and related storage calls, but this file shows no retention warning, storage policy disclosure, or user control before writing privacy-sensitive records. Persistent logging raises the impact of accidental exposure, local compromise, or multi-user device access.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The HTML exporter inserts unescaped database content, especially summary text and activity-derived values, directly into HTML markup. If any stored content contains HTML or script payloads from visited pages, titles, or LLM-generated summaries, opening the exported report in a browser could execute attacker-controlled JavaScript, exposing local report data or performing actions in the browser context.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The daily summary path packages detailed user activity and transcript snippets and immediately sends them to the external LLM through `_call_ai` without a just-in-time user warning or confirmation at the transmission point. In a life-logging context, this is especially risky because the data is highly personal and may reveal habits, interests, work context, and other sensitive behavioral information.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The export feature writes potentially sensitive activity history, keywords, and transcripts to an arbitrary user-specified path without any warning about confidentiality, file permissions, or downstream exposure. In a privacy-sensitive tracker, silent export materially increases the chance of accidental data leakage through shared directories, backups, or sync services.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The generate command processes tracked user activity and summaries with an LLM provider, and the configuration supports remote APIs such as OpenAI, Groq, and Qwen. Because the command does not present a runtime warning or confirmation, users may unknowingly transmit highly sensitive local activity data to third-party services.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The configuration flow stores the API key in llm_settings.json after prompting for it, which creates a plaintext local credential copy in addition to any secure storage helper. Users are not clearly warned that the key will persist on disk, creating exposure through local compromise, backups, or accidental file sharing.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The setup script installs and immediately starts a background activity-collection service, but it does not present a prominent warning that ongoing monitoring will continue after installation. Given the skill's purpose is to track browser history and active windows, silent persistence materially increases privacy risk and can lead users to unknowingly expose sensitive behavioral data.

Static analysis

No suspicious patterns detected.