Security audit

daily-agent

Security checks across malware telemetry and agentic risk

Overview

This skill is a broad task orchestrator that also stores user memory, runs local scripts, creates skills, and commits files automatically, so it should be reviewed carefully before installation.

Install only if you want a highly privileged daily workflow orchestrator. Before using it, review or disable the automatic profile observer, memory writes, git commit step, skill creation flow, and host script hooks, especially the absolute-path bash and PowerShell commands. Do not use it in workspaces containing sensitive personal, business, or credential-bearing material unless those persistence and execution paths are constrained.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (21)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill clearly performs file read/write behavior but does not declare permissions or boundaries for those capabilities. In an orchestration skill, hidden persistence and file mutation increase the chance of unintended writes, policy bypass, or broader access than users expect.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared purpose is task orchestration, but the skill also persists user profiles, writes memory, creates skills, performs git commits, and invokes local scripts. This scope expansion is dangerous because operators may trust it as a router/orchestrator while it silently acquires durable state-changing behavior beyond that role.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The PreTask hook instructs direct execution of a local bash script from the host environment. For a routing skill, host-script execution materially expands privilege and creates a path for arbitrary local code execution or execution of stale/untrusted hooks.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The skill introduces direct execution of a local Python parallel executor, which exceeds the minimum needed for orchestration. This widens the attack surface by allowing host-side script execution and makes behavior dependent on local files outside the skill definition.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: Automatic git add/commit in a dispatcher skill is a repository write side effect that can persist unintended or sensitive changes. In the context of an agent that also updates memory and profiles, this could commit private data or attacker-influenced content without meaningful review.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: Automatically creating new skill drafts and SKILL.md files gives the orchestrator self-extension capability beyond its stated role. This can be abused to plant new prompts/instructions that persist across sessions and expand future agent behavior.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The skill persists user preferences and profile data into memory and USER.md even though its main purpose is orchestration. This is risky because it creates durable personal data storage from ordinary conversations without clear consent or minimization controls.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The L1 sync step invokes a local PowerShell script, adding host-level script execution to a task-routing skill. This is particularly dangerous because it occurs during wrap-up, where users may not expect privileged background actions or additional persistence.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The code implements persistent storage of user observations and facts to a disk-backed profile file, which is not justified by the stated purpose of a long-chain task orchestration skill. This creates unnecessary privacy and surveillance risk because conversation-derived user attributes are retained beyond the immediate task lifecycle without clear need, consent, or minimization.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The file header and usage text describe extracting facts from conversation text and saving them into a persistent user observations store, while the skill metadata presents the skill as an orchestration component. This mismatch is dangerous because it can hide data collection behavior from reviewers, operators, and users, reducing the chance that sensitive profiling is properly scrutinized or consented to.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: create_skill accepts a user-controlled output_dir and name, then uses os.path.join and os.makedirs/write operations without constraining the final path to an approved base directory. An attacker or untrusted caller could cause files or directories to be created outside the intended skills area, potentially overwriting or planting content in sensitive locations reachable by the running user.

Vague Triggers

High

Confidence: 88% confidence
Finding: The Converse trigger list includes very broad phrases like '怎么样' or '你觉得呢', making it easy to misclassify actionable requests as discussion-only. In this skill, misclassification matters because Converse mode suppresses execution and changes data-handling behavior, enabling denial of intended actions or inconsistent policy enforcement.

Missing User Warnings

High

Confidence: 91% confidence
Finding: The skill instructs automatic execution of external scripts and shell commands without prominent user-facing warning or approval. Because these actions can affect the host system and local files, the absence of explicit risk disclosure increases the chance of unsafe, surprise execution.

Missing User Warnings

High

Confidence: 96% confidence
Finding: The skill directs automatic updates to user profile and memory files without clear privacy notice or consent. This is dangerous because personal preferences and observations are durable data, and users may not realize normal conversation is being transformed into stored profile information.

Vague Triggers

High

Confidence: 97% confidence
Finding: The manifest description states that this skill should be invoked for 'all conversations' and automatically activated on any user message, which is an overly broad trigger for a powerful orchestration skill. In this context, the skill can classify tasks, route execution, spawn sub-agents, and schedule cron-like work, so universal auto-activation increases the chance of unnecessary privilege use, unintended delegation, and abuse of downstream capabilities.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The script writes extracted user facts to a persistent JSON file under memory/user_observations.json without any user-facing warning, consent flow, or retention notice. Persistent storage of conversationally derived profile data can expose sensitive personal information to later misuse, overcollection, or compromise of the host environment.

Ssd 3

Medium

Confidence: 97% confidence
Finding: The skill explicitly instructs persisting and updating user preference/profile data from conversations into memory files. Persistent storage of conversationally derived personal data is sensitive, and in this context it occurs inside a general orchestration skill without clear consent or strict data minimization.

Ssd 3

Medium

Confidence: 94% confidence
Finding: Writing discussion summaries and pending actions into persistent memory creates durable records of potentially sensitive user intent. Even if framed as helpful continuity, it expands data retention from a chat interaction into stored operational memory without clear necessity.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The end-of-task rules broadly direct updates to long-term memory, ontology, and L1 sync based on conversation content and user preferences. Broad, automatic persistence is dangerous because it converts many routine interactions into durable knowledge artifacts, increasing privacy and integrity risks.

Ssd 3

Medium

Confidence: 94% confidence
Finding: The natural-language description explicitly states that the component passively records user profile information extracted from conversations and stores it in a persistent file. Passive profiling of users from conversation content is inherently privacy-sensitive, and in the context of an orchestration skill it is especially risky because it broadens collection beyond the stated operational purpose.

Ssd 3

Medium

Confidence: 93% confidence
Finding: The CLI interface and comments instruct the system to extract observations from dialogue text and record them as user facts, operationalizing passive user profiling. This is dangerous because it lowers the barrier to routine collection and persistence of personal inferences, potentially including sensitive or inaccurate attributes, without user awareness.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.