Security audit

Driver Card Tachograph

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what it claims, but it handles sensitive driver-card data with weak disclosure and has under-documented email alerting plus unsafe filename handling.

Review before installing or running. Use only trusted .ddd filenames, pin and verify the external parser source before building, leave MAIL_TO unset unless outbound alerts are approved, and treat all generated databases, CSVs, logs, summaries, and archives as sensitive driver records requiring restricted storage and retention controls.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The script conditionally sends outbound email based on the MAIL_TO environment variable, disclosing that processing of a specific tachograph file triggered ASN.1 parsing errors. Even though the content is limited, this creates an unexpected exfiltration path from a data-processing workflow and can leak operational or potentially sensitive file-derived context to an external recipient without explicit approval in the script interface.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill processes highly sensitive tachograph and driver card data, then persists it to SQLite and exports it to CSV, but the description does not clearly warn users about the privacy and data-handling implications. This can lead to inadvertent exposure of personally identifiable, operational, and compliance-related data through local storage, downstream sharing, or insecure handling of exported files.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The script exports personally identifiable and operationally sensitive tachograph data into plaintext CSV files and also records metadata about those exports, without any access-control checks, minimization, consent/warning, or protective handling. In this skill context, the data includes driver identity, card numbers, dates of birth, vehicle identifiers, and work/activity records, so unauthorized export or careless handling could lead to privacy breaches, regulatory exposure, and operational intelligence leakage.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: This script imports highly sensitive personal, behavioral, and geolocation data into a persistent SQLite database without any consent prompt, retention notice, minimization, encryption, or access-control safeguards. In this context, the data includes identity details, birth date, vehicle history, work/activity logs, border crossings, and GNSS location records, so silent long-term storage materially increases privacy, insider misuse, and breach impact.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The alerting path may transmit processing details externally without any user-facing notice or explicit consent mechanism. In this skill context, the workflow processes tachograph/driver-card data, so even metadata about files failing ASN.1 validation can be operationally sensitive and should not be silently sent off-host.

Static analysis

No suspicious patterns detected.