Security audit

Writing Triadic

Security checks across malware telemetry and agentic risk

Overview

This is not malware, but it should be reviewed because it builds long-term local writing and style profiles while its retention and deletion promises are inconsistent.

Review the privacy file before installing. Use this only for writing projects where local retention of drafts, preferences, SEO history, and style fingerprints is acceptable. Prefer local privacy mode or no-web-search for sensitive drafts, and manually delete MEMORY.md, session folders, style profiles, and the knowledge base if you do not want long-term reuse.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (26)

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The skill’s retention and deletion promises are internally inconsistent: it says data is deletable and defaults to 90-day retention, but later states historical sessions are not deleted and the knowledge base is 'never deleted, only appended.' This can cause users to believe their data will be removed when significant artifacts may persist indefinitely, creating privacy and compliance risk.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The claim that 'all data is only stored locally' conflicts with later workflow steps that send search terms and topic details to external web-search services. Even with a consent gate, the absolute privacy claim is misleading and may cause users to disclose sensitive information under false assumptions about data handling.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The prompt explicitly instructs the agent to read and later update persistent files such as MEMORY.md and a knowledge base across writing sessions. Even if framed as personalization, this creates durable stateful data access beyond the immediate task and can expose or retain user information without clear scope, minimization, or consent controls.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The prompt authorizes spawning an Evolution Analyst via sessions_spawn, expanding the skill from content generation into cross-agent orchestration. That additional capability increases attack surface and can propagate sensitive session data to other agents or contexts without a clearly justified boundary.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The guide explicitly instructs persistent storage of detailed style-clone profiles, calibration history, drift history, and writing records in MEMORY.md. That creates long-lived user profiling and retention of behavioral metadata beyond what is necessary for a single writing task, increasing privacy risk if the memory is exposed, reused unexpectedly, or retained without clear user consent and data-minimization controls.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The drift-tracking section introduces cross-session comparison of recent outputs against a stored baseline, which is a form of longitudinal behavioral monitoring. Even if intended for style quality, it enables ongoing inference about changes in a user's writing behavior over time, expanding the system from simple transformation into persistent profiling.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The multi-profile archive and automatic switching logic builds separate behavioral profiles for different contexts and infers which one to use from the user's task. This increases profiling depth and introduces context inference about the user's activities, which can reveal sensitive patterns about work, academic, or social usage beyond basic style imitation.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The activation examples are extremely generic (e.g., 'help me write a blog', 'write a product blurb', 'optimize my resume'), which creates a broad trigger surface for ordinary user requests. In an agent ecosystem, this can cause the skill to auto-engage unexpectedly, leading to unplanned memory use, style/profile loading, consent prompts, or workflow takeover when the user may have intended a simple one-off response.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The README advertises activation through very broad, ordinary writing requests such as blog posts, reviews, resumes, and social posts, without defining explicit invocation boundaries or requiring clear user confirmation that the skill should run. In agent ecosystems, this can cause overbroad triggering and unintended execution in contexts where the user did not mean to invoke a multi-phase workflow with research, memory use, and automated decision-making.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The workflow states that the skill performs 'Web research + knowledge base update' and later 'updates memory and statistics,' but the README does not clearly warn users about network access, data retention, or persistence side effects. This can lead to silent transmission of user content to external services and unexpected storage of preferences or writing material, which is especially risky for sensitive drafts like resumes, reviews, or internal documents.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger list is broad enough to activate on many ordinary phrases like 'write,' 'article,' or 'draft,' increasing the chance that the skill engages unexpectedly. In this skill, unexpected activation is more risky because it immediately begins reading and persisting user preference data, potentially causing unintended data collection and workflow hijacking.

Natural-Language Policy Violations

Medium

Confidence: 91% confidence
Finding: The guide explicitly instructs an executor to enforce a specific writing style and penalize outputs that do not conform, without any indication that the end user opted into those constraints. In an agent skill, this can override user intent, steer outputs away from requested tone or format, and create hidden behavioral shaping that is not transparent to users.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill directs the system to silently read and update persistent user profile files before interacting with the user. Because this access and storage behavior is not disclosed in a user-facing notice, users may unknowingly provide content that is harvested into long-term memory and reused later.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: This section instructs the agent to read and update MEMORY.md as persistent state, including conflict handling and incremental statistics, without any requirement for explicit user consent or a visible warning before modifying long-lived data. That creates a memory-poisoning and privacy risk: transient, adversarial, or misclassified session content can be stored and later influence future outputs across sessions.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: This portion goes further by directing direct append, update, and even overwrite behavior for MEMORY.md, again without user-facing warning or approval. The danger is amplified because the prompt frames the output as immediately mergeable or directly writable, enabling persistent corruption of memory/state, retention of sensitive user feedback, and cross-session manipulation if malicious content enters the analysis pipeline.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: The document explicitly references a dedicated 'anti-detect' rewrite mode for evading AI-detection systems and recommends importing similar de-AI-ification rules into another writing skill. Even though this appears as architectural research notes rather than executable code, it still preserves and propagates guidance for evasion behavior, which can facilitate policy circumvention or deceptive content generation when adopted downstream.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger conditions are broad enough to activate long-form behavior for many ordinary writing requests, which can cause the agent to switch into a more persistent, structured workflow without clear user intent. In a skill that spans multiple sessions and reads memory/manifest state, over-triggering increases the chance of unwanted context carryover, incorrect mode selection, and user steering into workflows they did not request.

Natural-Language Policy Violations

Medium

Confidence: 79% confidence
Finding: Mandating Chinese terminology globally without user choice hard-codes a language convention that may override user preferences, project requirements, or locale-specific norms. This is primarily a policy and usability risk, but in document-generation contexts it can also produce incorrect or noncompliant outputs when a different language or terminology standard is required.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill instructs automatic updates to MEMORY.md after each writing session without any explicit user notice, consent, or retention controls. Persistent state modification can silently store user preferences, topics, and workflow-derived SEO history, creating privacy, data-minimization, and cross-session leakage risks—especially if later tasks can read or act on that memory.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The prompt requires retaining and reusing detailed preferences, dislikes, and correction history across sessions, then folding them into future outputs. This persistent profiling can unintentionally reveal prior user data in later generations and creates privacy risk if storage is overbroad or shared across contexts.

Ssd 3

Medium

Confidence: 98% confidence
Finding: The style-cloning workflow extracts an enduring 'style fingerprint' from user writing samples and saves it for future automatic use. That is a form of persistent biometric-like behavioral profiling of authored text, which raises consent, privacy, and misuse concerns, especially if samples contain sensitive or identifying traits.

Ssd 3

Medium

Confidence: 94% confidence
Finding: Automatically injecting historical preferences, bans, and prior corrections into future writing rules creates a direct path for prior-session data to influence or surface in new outputs. In a multi-user, shared, or mis-scoped environment, this increases the risk of unintended disclosure and context bleed between sessions.

Ssd 3

Medium

Confidence: 96% confidence
Finding: This section explicitly describes extracting style features from user-provided text and persistently saving them to MEMORY.md for future automatic reuse. That creates a cross-session data retention channel for potentially sensitive personal writing traits, proprietary text, or embedded confidential information, and broad reuse increases the chance of unintended disclosure or secondary use beyond the original purpose.

Ssd 3

Medium

Confidence: 97% confidence
Finding: The statement that every user utterance is 'free training data' and should become a permanent rule normalizes indiscriminate collection and retention of user inputs. In practice, user messages may contain personal data, confidential work details, or regulated content, so converting all of it into permanent memory creates unnecessary privacy and data governance risk.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The workflow says future writing will automatically inject the stored style profile, implying broad automatic reuse of previously supplied user data across later interactions. Automatic cross-session injection can leak prior context into unrelated outputs, amplify prompt-injection persistence, and make it harder for users to understand when their historical data is being used.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.