Security audit

Smart Follow-ups

Security checks across malware telemetry and agentic risk

Overview

This skill matches its stated purpose of generating follow-up questions, with some privacy and trigger-scope cautions but no evidence of malicious behavior.

Safe to install if you are comfortable with recent chat context being used to generate suggestions. Prefer explicit /followups use, keep autoTrigger disabled unless you really want suggestions after every response, and avoid storing API keys in shell startup files when using the standalone CLI.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill metadata advertises no explicit permissions, yet the described behavior includes environment access and outbound network use via external model providers. This undermines least-privilege expectations and can cause operators or users to underestimate the data exposure surface, especially when recent conversation context may be transmitted off-platform.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documented purpose says the skill simply generates three follow-up buttons, but the described behavior is materially broader: it can call third-party AI services, persist suggestions in session state, and later intercept numeric replies to transform them into different prompts. That mismatch is dangerous because it obscures data flows and message-handling side effects, preventing informed consent and making accidental triggering or hidden prompt substitution more likely.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill transmits recent conversation content to external LLM providers (OpenRouter or Anthropic), which conflicts with the apparent expectation of a lightweight local follow-up UI feature. Even though the prompt says to treat conversation text as opaque data, the code still exfiltrates user/assistant content off-host, creating privacy and data-handling risk if users are not clearly informed.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The guide instructs users to persist an API key by appending it directly to shell startup files, which stores the secret in plaintext in a long-lived location. This increases exposure to local compromise, accidental disclosure through dotfile backups/sync, shell history mistakes, or screen-sharing/copy-paste leakage.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: Broad trigger phrases such as generic words like 'followups', 'suggestions', or 'what should I ask' are likely to match ordinary conversation rather than an intentional command. In a multi-channel chat setting, this can activate the skill unexpectedly, capture recent context, and potentially send that context to external providers without a clear user action.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The usage text says users can say 'followups' in any conversation and lists broad natural-language examples, which normalizes implicit activation without clear boundaries. This increases the chance of accidental invocation and unintended processing of conversation history, especially on channels where users may not realize they are invoking a tool rather than chatting normally.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill explicitly states it captures recent conversation context to generate follow-ups, but the user-facing description and trigger guidance do not warn that this context may be processed for generation or sent to configured external providers. This is a privacy and transparency issue because users may reveal sensitive information in the chat without realizing that invoking the skill changes how their prior messages are handled.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The code sends conversation context to an external API endpoint without any visible user warning, consent flow, or redaction step. Because conversation history may contain secrets, personal data, or proprietary content, this can cause unintended disclosure to third-party providers.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: Auto-triggering follow-up generation on every assistant reply creates an overly broad invocation surface that can cause unbounded or unintended model calls. In chat environments, this can lead to prompt amplification, user confusion, cost abuse, and accidental generation of context-derived suggestions in situations where the user did not request them.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The documentation promotes automatic follow-up generation after every assistant response without warning that suggestions may reveal or restate sensitive context in shared chats. This increases the risk of message spam, inadvertent disclosure of prior conversation topics, and privacy issues when the assistant surfaces context-derived prompts where other participants can see them.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The trigger phrases include generic terms like "suggestions" and "what should I ask", which are likely to appear in normal conversation and can cause the skill to activate unintentionally. In a chat environment, this can hijack user intent, inject unsolicited UI/buttons, and interfere with routing to other skills or the base assistant.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: cli/followups-cli.js:92