Security audit

Continuity Framework

Security checks across malware telemetry and agentic risk

Overview

This skill is not malicious, but it is a memory tool that can retain and resurface conversation-derived identity, relationship, and question data without enough user-facing controls.

Install only if you deliberately want an agent to keep local continuity memories from prior conversations. Keep the memory directory private, avoid giving it transcripts with secrets or sensitive personal data, enable heartbeat reflection only with explicit user consent, and periodically review or delete the generated memory files.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill instructs use of environment variables and writes persistent data under a memory/ directory, but it does not declare permissions or clearly scope those capabilities. Hidden or undeclared file-write and env usage reduces reviewability and can let a seemingly simple memory skill persist sensitive user data or alter local state without explicit operator awareness.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 84% confidence
Finding: The documented behavior goes beyond passive reflection into broader local state management, question workflows, and identity-related persistence, creating a mismatch between what reviewers expect and what the skill operationally supports. Description-behavior mismatch is dangerous because it can hide privacy-impacting functionality and cause the skill to be enabled in contexts where operators did not consent to its full capabilities.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill is explicitly designed to store memories, questions, relationships, and identity updates across sessions, but the description does not prominently warn that user-related data is persisted long-term. This is a privacy and consent issue because sensitive inferences about users and relationships may be retained, surfaced later, or combined into a profile without clear notice.

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: The script persists session-derived analysis to disk automatically in a memory directory without any consent prompt, retention control, or warning about persistence. In a continuity/memory skill, this is more dangerous because the whole feature centers on retaining conversational content across sessions, which can unintentionally store sensitive personal, organizational, or credential-adjacent information long term.

Ssd 3

Medium

Confidence: 90% confidence
Finding: The reflection workflow is designed to retain and serialize information from prior conversations across sessions, creating a durable memory store of potentially sensitive user content. In this skill context that raises real privacy and data-handling risk because users may not expect transcripts, inferred identity updates, and questions to be stored indefinitely in plaintext local files.

Ssd 3

Medium

Confidence: 91% confidence
Finding: The greeting flow automatically resurfaces stored prior-conversation questions and narrative content without checking for sensitivity, appropriateness, or user context. In a continuity skill this can expose private or embarrassing material to the wrong audience, especially in shared terminals, recorded sessions, or when the stored content contains sensitive personal or business information.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.