Security audit

Case Extraction

Security checks across malware telemetry and agentic risk

Overview

This case-extraction skill is aligned with its stated purpose, but it can persist sensitive chat content in predictable local files without enough warning or user control.

Review before installing if you will process confidential interviews, customer data, or internal chats. Use it only with files you are authorized to process, choose storage locations carefully, and consider modifying or avoiding the parser unless the _cleaned_temp.txt side file is removed or explicitly approved.

SkillSpector

By NVIDIA

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill describes reading uploaded chat records and writing a generated document to disk, but it does not declare corresponding permissions or boundaries for file access. Undeclared file read/write capability weakens the trust model and can lead to unexpected access to sensitive local files or silent file creation if the runtime grants broader filesystem access than the user expects.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: A description-behavior mismatch is security-relevant because users may consent to a harmless-seeming document extraction workflow while the implementation performs different actions such as command-line-only processing and writing undeclared temporary files near source material. When behavior diverges from the declared purpose, users cannot accurately assess privacy, integrity, and data handling risks, especially for sensitive chat transcripts containing personal or business data.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The script persists cleaned chat content to `_cleaned_temp.txt` even though its documented behavior is only to parse and print text. Because the input is user chat logs, this creates an undisclosed local data-retention channel that may expose sensitive business or personal information to other users, backup systems, or later processes.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: Writing output to a fixed local path without an explicit warning or consent can expose sensitive extracted case data to other local users, backup systems, or unintended directories. Fixed-path writes also create predictability that can overwrite prior documents, leak filenames, or conflict with local security policies.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The skill processes chat logs and case materials that are likely to contain personal, commercial, or confidential details, yet it does not provide a clear privacy notice about collection, extraction, storage, and quoting of that content. In this context, omission of privacy handling is dangerous because the workflow explicitly encourages retaining original statements and generating persistent documents from sensitive source material.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script saves user chat content to disk without prior warning or consent, which is risky given this skill processes chat transcripts that may contain confidential or regulated data. In the skill context, this is more dangerous because users are likely providing internal case discussions and best-practice conversations, increasing the chance of sensitive information being retained unexpectedly.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.