Security audit

llm-session-handoff-assistant

Security checks across malware telemetry and agentic risk

Overview

This skill has a legitimate handoff purpose, but it can broadly inspect and package project files, uploads, git history, and conversation context without a clear consent or review step.

Install only if you want an agent to prepare full project handoff bundles. Before using it, explicitly tell the agent which directories and files may be included, exclude secrets and private documents, and ask to review the attachment manifest before any zip or downloadable package is produced.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The activation criteria are very broad and include common requests like summarizing project status, exporting context, or saving files, which can cause the skill to trigger in situations where the user may not expect full-project inspection and packaging. This increases the chance of over-collection and unintended disclosure because the skill escalates a simple summary request into directory review, history review, and artifact bundling.

Missing User Warnings

High

Confidence: 96% confidence
Finding: This section explicitly tells the agent to inventory, copy, preserve, and package uploaded files, generated files, and project directory contents for download or transfer to another AI, but it does not require a clear user-facing privacy warning or scoped consent. That creates a substantial risk of bundling sensitive secrets, credentials, personal data, proprietary source files, or unrelated workspace contents into a handoff artifact.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill directs proactive inspection of project directories, key files, git history, and full conversation history before writing the package, without first telling the user exactly what will be accessed. Even if intended to improve accuracy, this behavior can expose sensitive code, commit metadata, or historical discussion content beyond what the user expected from a handoff request.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The instruction to gather and preserve all user-provided and conversation-derived files for handoff materially increases data retention and redistribution risk. Because the package is designed for download or transfer to another AI, any over-collected sensitive material becomes easier to exfiltrate, persist, and reuse outside the original conversation context.

Ssd 3

Medium

Confidence: 90% confidence
Finding: Reviewing the entire conversation history and extracting long-term user preferences into a transfer document can propagate sensitive behavioral data or personal context to a new AI session unnecessarily. The danger is amplified because 'preferences' is loosely defined and may lead to inclusion of information the user did not intend to preserve or share beyond the current chat.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.