Security audit

Kannaka

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent as a memory and swarm tool, but it also exposes broad autonomous coding, shell, network, and paid external-compute capabilities without enough scoping or safety guidance.

Review this skill before installing if you do not want an agentic tool that can run shell/filesystem workflows through an external binary, join a NATS swarm, modify Claude statusline settings, and optionally use qBraid services. Use plan/no-quantum modes where possible, avoid joining untrusted swarms, and confirm what binary and release verification are used before running install.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The documented `agent` command grants autonomous filesystem and shell-tool access, which materially expands the skill from memory/sync operations into arbitrary agentic execution. That creates a clear capability-escalation risk: a user invoking a seemingly HRM/swarm skill could be induced to run code, modify files, or execute shell actions well beyond the manifest’s stated scope.

Context-Inappropriate Capability

Medium

Confidence: 79% confidence
Finding: The qBraid-backed quantum operations introduce external compute execution and potential paid-hardware usage that are not reflected in the manifest description. While not inherently malicious, exposing real hardware/remote execution features without clear disclosure can lead to unintended network use, cost incurrence, and broader capability than users expect from a memory/statusline skill.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: Documenting `forget <id>` without any warning or confirmation guidance makes destructive data deletion easy to trigger accidentally or through prompt manipulation. In a memory-management system, deletion affects integrity and availability of stored context, and the lack of safety UX increases the chance of irreversible loss.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: An autonomous coding loop with filesystem and shell tools is a high-risk capability, and the absence of a strong safety warning materially increases misuse risk. Users may not appreciate that invoking this command can read, write, and execute in the environment, enabling prompt-induced destructive actions or unauthorized changes.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: `swarm join` over NATS implies outbound network connectivity and agent-to-agent synchronization, but no privacy, data-sharing, or trust-boundary disclosure is provided. In the context of a memory system, joining a swarm can expose metadata, content, or behavioral signals to external peers without the user understanding the confidentiality implications.

Static analysis

No suspicious patterns detected.