Security audit

Knowledge Vault

Security checks across malware telemetry and agentic risk

Overview

The skill’s knowledge-vault purpose is coherent, but it gives agents broad authority to fetch, store, index, and later reuse content without clear consent or retention boundaries.

Install only if you are comfortable with an agent fetching and retaining linked or uploaded content in a searchable vault. Use explicit save/digest commands, avoid confidential documents unless you understand where full text and memory summaries are stored, and review any dashboard or delete/update implementation for authentication, confirmations, and recovery controls before relying on it.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The README advertises activation on extremely generic input such as sending 'any video, article, podcast, or document' and 'just paste the link,' which can cause the skill to engage on routine user behavior without clear boundaries. In an agent environment, broad triggers increase the chance of unintended processing of sensitive or irrelevant content and make consent ambiguous.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The Quick Start says 'Send a link — any article, video, or document' and implies the agent will automatically digest and store it. This encourages overly broad activation behavior and omits safeguards around scope, user intent, and confirmation, making accidental ingestion more likely.

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: The README promotes instant digestion and storage in a 'personal, searchable vault' but does not warn users that submitted links, documents, and extracted content may be processed, retained, and indexed. That omission creates privacy and data-handling risk, especially if users provide confidential materials assuming transient processing.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The README states that content is 'automatically categorized, tagged, and saved' without warning that links and uploaded content may be permanently stored in memory or a vault. In a skill designed for long-term retrieval, this is particularly risky because users may unintentionally create durable records of sensitive information.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The setup prompt instructs the agent to create directories and write files in the local workspace without an explicit warning that it will modify state on disk. In an agent setting, this can lead to unintended filesystem changes or overwrite existing data if the user pastes the block without understanding its side effects.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The usage trigger is extremely broad, including phrases like 'says anything related to saving, recalling, or searching previously ingested knowledge,' which can cause the skill to activate during ordinary conversation. In this skill, accidental activation is risky because it can trigger URL fetching, content ingestion, storage to local files, and possible long-term memory writes without a clear, explicit user intent boundary.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The description markets the skill as a research library but does not clearly warn users up front that fetched content, summaries, tags, full text, and derived memory summaries may be stored in local JSON files and long-term memory. This undermines informed consent and is especially sensitive because the skill explicitly stores personal notes, full extracted text, and recall data across sessions.

Missing User Warnings

Low

Confidence: 89% confidence
Finding: The example depicts a state-changing action that moves an item and implicitly creates a new collection without showing any confirmation, warning, or clear disclosure that stored vault data will be modified. In a vault or knowledge-management skill, normalizing silent writes can lead users to trigger unintended organization changes, especially if examples are used as behavioral guidance for agent implementations.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The example includes concrete health-related recommendations such as delaying caffeine, using cold showers, and altering reward behaviors without any medical disclaimer, risk context, or suggestion to consult a professional. Even though this is presented as a YouTube digestion example, users could treat the guidance as trustworthy advice and apply it despite contraindications such as cardiovascular issues, anxiety, or other health conditions.

Context Leakage

High

Category: Data Exfiltration
Content: - **Articles/Web pages:** Use `web_fetch` to extract readable markdown. If the page is paywalled or blocks extraction, try `browser` tool as fallback. - **YouTube:** Use the `summarize` skill/tool if available. Otherwise, use `web_fetch` on a transcript service URL or `web_search` to find the transcript. Extract video title, channel, duration, and publish date from the page. - **PDFs:** Use the `pdf` tool to extract and analyze content. For URLs, pass the URL directly. - **Tweets/X threads:** Use `web_fetch` or `browser` to capture the full thread. Capture author, date, engagement metrics if visible. - **Reddit:** Use `web_fetch` on `old.reddit.com` version of the URL for cleaner extraction. Capture OP + top comments. - **GitHub repos:** Use `web_fetch` on the README. Optionally fetch key source files if the user asks for a deeper analysis. - **Podcasts:** Use `summarize` skill if available, or `web_fetch` on transcript page.
Confidence: 91% confidence
Finding: The instruction to 'capture the full thread' and similarly ingest top comments/full text drives collection of large amounts of third-party and potentially sensitive content beyond what is necessary to answer the user's request. In this skill, that risk is amplified because the content is then stored in `full_text`, made searchable, and may be summarized into long-term memory, increasing persistence and exposure of scraped personal data.

Tool Parameter Abuse

High

Category: Tool Misuse
Content: GET /api/vault/[id] — Get single entry POST /api/vault — Create entry (agent writes here) PATCH /api/vault/[id] — Update entry (notes, tags, collection) DELETE /api/vault/[id] — Delete entry GET /api/vault/collections — List collections with counts POST /api/vault/collections — Create collection
Confidence: 89% confidence
Finding: The spec exposes a destructive DELETE endpoint for vault entries but does not define any authorization, ownership checks, CSRF protections, or safe parameter validation around the id path parameter. In a dashboard connected to the same database the agent writes to, an attacker or unauthorized client could delete arbitrary records if the route is implemented as specified without strict auth and input handling.

Tool Parameter Abuse

High

Category: Tool Misuse
Content: GET /api/vault/collections — List collections with counts POST /api/vault/collections — Create collection DELETE /api/vault/collections/[name] — Delete collection GET /api/vault/stats — Vault statistics GET /api/vault/tags — All tags with counts
Confidence: 92% confidence
Finding: The collection deletion route uses a user-controlled collection name in the path and the spec does not describe authorization, validation, or safeguards for deleting shared resources. If implemented naively, this could allow unauthorized deletion of collections, path/parameter mishandling, or cascading integrity issues affecting many vault entries tied to that collection.

VirusTotal

54/54 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: SKILL.md:18