Security audit

Solo Forge

Security checks across malware telemetry and agentic risk

Overview

Solo Forge is a coherent local business assistant, but it can read and change sensitive client, deal, payment, and project-status JSON records through broad natural-language triggers without consistent confirmation.

Review before installing if you plan to store real client, contract, payment, or business data. Keep the JSON files out of shared repositories and unprotected synced folders, back them up, and manually confirm any proposed writes to deals.json, clients.json, or config.json, especially payment updates and project status changes.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (11)

Vague Triggers

High

Confidence: 94% confidence
Finding: The trigger phrase “帮我” is extremely broad and likely to collide with normal conversation, causing the skill to activate outside the user’s intended business workflow. In an agent environment, overbroad activation can lead to unintended routing, loading of business logic, and possible read/write operations against local project data when the user only meant to ask for generic help.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The README emphasizes persistent reads/writes to local JSON files containing client, deal, pricing, and payment-history data, but it does not prominently warn users that sensitive business information will be stored on disk. This creates risk of accidental exposure through insecure local storage, backups, shared machines, repo mistakes, or users misunderstanding the persistence model.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger list includes very broad, everyday phrases such as conversational fragments and generic business terms, which can cause the skill to activate the wrong module on ambiguous input. In a document-generating assistant that also reads and writes local JSON data, unintended routing can lead to inappropriate data access, confusing outputs, or accidental preparation for state-changing actions the user did not clearly request.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill explicitly instructs direct creation and modification of JSON files, including creating missing files, without an equally explicit requirement for user confirmation before every write operation. Because the skill manages business records, this can result in silent or unexpected state changes, data corruption, or persistence of hallucinated/default values into user data.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger phrases are generic natural-language commands such as “添加客户”, “客户列表”, and “更新客户” without explicit confirmation, authorization, or scoping rules. In an agent setting, broad triggers can cause unintended reads or writes to customer records when a user’s message is ambiguous, quoted, or part of a broader discussion, leading to accidental data modification or disclosure.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The module states that customer data is read from and written to `data/clients.json`, but there is no user-facing warning that invoking this skill persists customer information locally. Because this module handles client profiles, contacts, notes, and research data, silent storage increases privacy, consent, and data-handling risk, especially if users provide sensitive business or personal information assuming the interaction is ephemeral.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The activation rule "当用户说'客户说XXX，怎么回'时加载此模块" is overly broad and can trigger on loosely related user phrasing without clear boundaries on business context, authority, or risk level. In an agentic system, broad routing conditions can cause the model to invoke negotiation guidance in inappropriate situations, leading to overconfident legal, pricing, or dispute-handling advice that may not fit the user's jurisdiction or actual contract terms.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The operation mapping uses broad natural-language triggers like '添加项目/新建项目' and '更新项目/已收款X元' without requiring explicit confirmation or scoped intent matching. In a skill that directly writes persistent JSON business records, casual conversation or ambiguous phrasing can unintentionally create, modify, or summarize sensitive project data.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The status transition rules auto-trigger on vague phrases such as '做完了', '验收通过了', and '项目取消了', then immediately update persistent status and timestamps. Because these are common conversational expressions, the agent may perform unintended lifecycle changes that affect billing, reminders, and downstream document generation.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The module states that all data is directly read from and written to JSON files and that missing files will be auto-created, but it does not specify user-facing warnings, consent, or safeguards around persistent modification. In a business assistant handling deals and client records, silent persistence increases the risk of accidental data creation, corruption, or unauthorized-looking changes from ambiguous requests.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The document says that when users say phrases like '做完了' or '验收通过了', the system automatically updates status and updated_at, but it does not clearly warn that this changes persisted project records. This is dangerous because users may think they are chatting informally while the system commits business-state changes that influence invoicing, collections, and reporting.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.