Security audit

Memo

Security checks across malware telemetry and agentic risk

Overview

The skill is a mostly coherent local memo assistant, but it asks agents to directly edit WorkBuddy's automation SQLite database for reminders without narrow scoping or clear user confirmation.

Review carefully before installing. Use it only if you are comfortable with local storage of work notes and exported reports, and disable or remove the direct SQLite automation fallback unless you explicitly trust it to modify WorkBuddy reminders. Prefer requiring confirmation before saving, exporting, deleting, or changing reminders.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (16)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill clearly instructs reading and writing local files (`records.json`) but does not declare corresponding permissions. This creates a transparency and least-privilege problem: reviewers and users cannot accurately assess what the skill can access, and an overbroad or implicit file capability can be abused or accidentally expanded later.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The skill recommends direct SQLite access to WorkBuddy's automations database as a fallback, which exceeds the core need of a memo/notepad skill and bypasses normal tool boundaries. Direct database manipulation can alter unrelated automations, corrupt scheduler state, or be repurposed to tamper with tasks outside the user's note workflow.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The description says persistence is in a local JSON file, but the workflow later requires access to and modification of a separate SQLite automation database. This mismatch undermines informed consent and security review because the actual data/control surface is broader than advertised.

Context-Inappropriate Capability

Medium

Confidence: 87% confidence
Finding: The skill labeled as a local memo/notebook also exposes helper methods that drive external automation behavior, including creating, updating, and deleting reminder tasks and generating recurrence rules. That expands the effective capability boundary beyond passive local record storage into action orchestration, which can cause unintended scheduled actions or persistence in external systems if the hosting agent trusts these outputs without additional authorization checks.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The README describes very broad natural-language usage such as '帮我记一下…' and positions the skill as a general personal assistant, which can overlap with ordinary conversation. In an agent ecosystem, overly broad triggers increase the chance the skill is invoked on incidental user text, causing unintended persistence of sensitive or irrelevant information to local storage.

Vague Triggers

Low

Confidence: 83% confidence
Finding: The loading/usage instructions only say to enter '加载记事本技能' and do not define strict trigger boundaries, exclusions, or disambiguation behavior. This can lead to accidental activation or overuse by the agent, especially because the skill performs persistent local writes and reminder automation, making misfires more consequential than a read-only skill.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: Several trigger phrases are broad everyday expressions such as completion or update language, which increases the chance the skill activates on ordinary conversation and performs state-changing actions. In this skill, accidental activation is more dangerous because it can write records, modify reminders, delete entries, and pause automations.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill auto-creates, updates, and pauses reminders based on parsed user text but does not require prominent notice or consent before these side effects occur. Because reminder creation and modification can affect the user's automation environment beyond note-taking, silent execution increases the risk of unwanted persistence and workflow manipulation.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The document not only allows but recommends direct writes to the local automations SQLite database without sufficient warning, validation, or scoping. This is especially dangerous because low-level database access bypasses safety checks that higher-level tools might enforce, enabling unauthorized or accidental modification of arbitrary automations.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The example phrases are broad, natural conversational requests that could match ordinary chat without a strong activation boundary. In an agent environment, this raises the risk of unintended invocation of a stateful skill that writes persistent records, causing accidental storage of user content or work details.

Vague Triggers

Medium

Confidence: 81% confidence
Finding: Phrases like asking what remains undone are highly conversational and could overlap with general assistant planning or status questions. Because this skill exposes long-term memory and task state, ambiguous triggering can leak prior notes or cause the agent to act on the wrong tool context.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: A generic export phrase can route ordinary requests into a file-writing action without sufficiently clear user intent. Since exporting creates files from persisted private work notes, accidental activation can produce unintended data disclosure artifacts on disk.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The manifest explicitly advertises local persistent storage and report export, but it does not warn users that data will be retained on disk or that files may be created. For a personal work-record skill handling potentially sensitive names, tasks, and internal operational details, missing transparency materially increases privacy and data-handling risk.

Ssd 3

Medium

Confidence: 86% confidence
Finding: Requiring the assistant to always echo the full original record content and event ID can expose sensitive work notes, names, schedules, or internal details in plain text on screen or in chat history. The risk is amplified because memo content is likely to contain confidential business information entered in natural language.

Ssd 3

Medium

Confidence: 87% confidence
Finding: The query workflow mandates returning every matched record with full content and event ID, which increases the chance of over-disclosing previously stored sensitive notes during broad searches or date-range queries. This is particularly risky for a long-term memory skill where historical entries may contain personal or business-sensitive details the user did not intend to re-display verbatim.

Ssd 3

Medium

Confidence: 89% confidence
Finding: A global rule requiring every reply to include each record's full content systematically normalizes plaintext disclosure of stored data. In the context of a persistent notebook skill, this broad disclosure pattern increases exposure through chat logs, shoulder-surfing, screenshots, and accidental retrieval of unrelated sensitive notes.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.