Back to skill

Security audit

πŸ€–πŸ€πŸ§  better collab with your agent

Security checks across malware telemetry and agentic risk

Overview

The skill locally analyzes user-provided ChatGPT exports to create a profile, which is sensitive but disclosed, user-controlled, and not shown to upload, hide, or automatically modify anything.

Install only if you are comfortable analyzing your ChatGPT export locally. Treat conversations.json, generated profiles, and prompt snippets as sensitive personal files; review, redact, and minimize them before adding anything to SOUL.md, AGENTS.md, repositories, or hosted agents. Use a virtual environment and consider pinning dependencies. Do not run test_wildchat.py unless you intentionally want to fetch and profile the external WildChat dataset.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (20)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill instructs users to read a local ChatGPT export and write derived profile data to local configuration files, but the metadata declares no permissions. That mismatch can cause users or policy engines to underestimate the skill's access to sensitive local data, especially because the input contains full conversation history and the output is designed to influence agent behavior.

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The test script pulls and analyzes a third-party public dataset (WildChat-1M) instead of limiting itself to user-provided ChatGPT exports, which expands the data-processing scope beyond the stated purpose in the skill metadata. This creates a data-governance and privacy-risk mismatch because the code operationalizes large-scale profiling of external conversations rather than only analyzing locally supplied exports.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The script groups conversations by hashed IP and generates per-user cognitive profiles, enabling cross-conversation tracking and behavioral profiling of distinct individuals. Even if hashed, this identifier is still a stable pseudonymous user key, and using it for profiling increases privacy risk well beyond simple conversation analysis.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The package summary promotes analysis of ChatGPT conversation exports but does not clearly warn that these exports can contain highly sensitive personal, professional, financial, medical, or credential-related information. Even though the document claims processing is local, users may still mishandle data, share outputs, or upload derived profiles without understanding the privacy risk, making this a real security/privacy weakness in the documentation.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The README explicitly instructs users to export their full ChatGPT conversation history and analyze it, but provides no warning that this dataset can contain highly sensitive personal, professional, medical, financial, or credential-related information. In the context of a profiling skill that derives cognitive archetypes and recommends adding insights to persistent agent memory files, the omission increases the risk of unnecessary collection, retention, and downstream exposure of sensitive data.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill encourages generating and applying a cognitive profile from conversation history without a clear warning that the output may contain sensitive behavioral inferences, preferences, and traits. Because the next step is to copy these inferences into persistent agent configuration files, users may unknowingly expose personal profiling data to future agents or other tooling that reads those files.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The cross-agent export section tells users to generate prompt snippets for other agents but does not warn that those snippets are derived from private conversation history and inferred traits. Sharing them with external agents or hosted services can disclose sensitive personal data, behavioral patterns, and profiling information beyond the local environment the skill otherwise emphasizes.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The methodology explicitly processes conversation content, titles, timestamps, keywords, and unique conversation IDs, all of which can contain sensitive personal or behavioral data. In a skill designed to profile users' cognitive archetypes, failing to prominently warn about privacy-sensitive processing and data minimization increases the risk of unexpected collection, profiling, retention, or misuse of personal information.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The tool is explicitly designed to process exported ChatGPT conversations and derive a persistent cognitive profile, but it provides no consent prompt, sensitivity warning, minimization guidance, or safeguards around highly personal content. In this skill context, the output can infer behavioral traits and communication preferences from private conversations, creating privacy and profiling risks if run on sensitive exports or shared onward.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The code fetches remote conversational data and performs cognitive profiling without any user-facing privacy notice, consent flow, or disclosure that third-party conversation content is being processed. Profiling sensitive behavioral patterns from conversation text raises privacy and compliance concerns, especially when the script is presented as a generic tester for a skill rather than a privacy-reviewed research pipeline.

Ssd 3

Medium
Confidence
95% confidence
Finding
The prompt-snippet mode converts analyzed conversation-derived traits into a reusable instruction block intended to shape future agent behavior, which operationalizes inferred personal attributes across later interactions. In this skill's context, that makes the profiling more dangerous because it enables persistent behavioral targeting, possible misclassification, privacy leakage into downstream prompt files, and hidden influence over future agent responses.

Unpinned Dependencies

Low
Category
Supply Chain
Content
# Install with: pip install -r requirements-test.txt

# Core skill requirements (from requirements.txt)
scikit-learn>=1.3.0
numpy>=1.24.0
PyYAML>=6.0
Confidence
95% confidence
Finding
scikit-learn>=1.3.0

Unpinned Dependencies

Low
Category
Supply Chain
Content
# Core skill requirements (from requirements.txt)
scikit-learn>=1.3.0
numpy>=1.24.0
PyYAML>=6.0

# WildChat dataset access
Confidence
95% confidence
Finding
numpy>=1.24.0

Unpinned Dependencies

Low
Category
Supply Chain
Content
# Core skill requirements (from requirements.txt)
scikit-learn>=1.3.0
numpy>=1.24.0
PyYAML>=6.0

# WildChat dataset access
datasets>=2.14.0
Confidence
96% confidence
Finding
PyYAML>=6.0

Unpinned Dependencies

Low
Category
Supply Chain
Content
PyYAML>=6.0

# WildChat dataset access
datasets>=2.14.0

# Optional: For faster streaming
# pyarrow>=12.0.0
Confidence
94% confidence
Finding
datasets>=2.14.0

Unpinned Dependencies

Low
Category
Supply Chain
Content
# Core dependencies
scikit-learn>=1.3.0
numpy>=1.24.0
PyYAML>=6.0
Confidence
91% confidence
Finding
scikit-learn>=1.3.0

Unpinned Dependencies

Low
Category
Supply Chain
Content
# Core dependencies
scikit-learn>=1.3.0
numpy>=1.24.0
PyYAML>=6.0

# Optional: For advanced BM25 ranking (script has built-in fallback)
Confidence
91% confidence
Finding
numpy>=1.24.0

Unpinned Dependencies

Low
Category
Supply Chain
Content
# Core dependencies
scikit-learn>=1.3.0
numpy>=1.24.0
PyYAML>=6.0

# Optional: For advanced BM25 ranking (script has built-in fallback)
# rank-bm25>=0.2.2
Confidence
93% confidence
Finding
PyYAML>=6.0

Known Vulnerable Dependency: scikit-learn==1.3.0 β€” 2 advisory(ies): CVE-2024-5206 (scikit-learn sensitive data leakage vulnerability); CVE-2024-5206 (A sensitive data leakage vulnerability was identified in scikit-learn's TfidfVec)

Medium
Category
Supply Chain
Confidence
90% confidence
Finding
scikit-learn==1.3.0

Known Vulnerable Dependency: scikit-learn==1.3.0 β€” 2 advisory(ies): CVE-2024-5206 (scikit-learn sensitive data leakage vulnerability); CVE-2024-5206 (A sensitive data leakage vulnerability was identified in scikit-learn's TfidfVec)

Medium
Category
Supply Chain
Confidence
82% confidence
Finding
scikit-learn==1.3.0

VirusTotal

55/55 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.