Security audit

mia-trust

Security checks across malware telemetry and agentic risk

Overview

This is a plausible trust-and-memory assistant, but it has a real command-injection risk and stores or sends sensitive prompt data with weak scoping and disclosure.

Review before installing. Use only in an isolated environment unless run.mjs is patched to use execFile/spawn with argument arrays and no shell. Avoid entering secrets or sensitive personal, medical, business, or security data unless persistence is disabled or the memory/trust files are redacted and managed. Prefer a trusted local or allowlisted model endpoint, and verify what data will be sent before setting API keys.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The documentation presents conflicting behavior for unsafe plans: it describes automatic repair and continued review, while also stating unsafe plans should stop and that repaired plans require user confirmation. In a trust/guard pipeline, this ambiguity can lead implementers to permit self-healing of dangerous plans instead of enforcing a hard fail, weakening the safety boundary and enabling risky actions to proceed.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The planner reads an API key and allows requests to a fully configurable endpoint via MIA_PLANNER_URL. Because the prompt includes user questions and optional historical plans, this creates a real data-exfiltration and secret-misrouting risk if the environment is misconfigured or attacker-controlled, especially since arbitrary URLs are permitted rather than a fixed allowlisted provider.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The runner constructs shell command strings with user-controlled input and passes them to execSync, which invokes a shell. Although quotes are escaped, shell metacharacters such as backticks or $(...) are not neutralized inside double quotes, so a crafted question can trigger command injection and arbitrary code execution. In this skill context, launching other modules is expected, but doing so through shell interpolation makes the trust pipeline substantially more dangerous because the input being 'guarded' is itself the untrusted source.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The skill can route queries, plans, memories, and evaluation prompts to a configurable remote endpoint via CUSTOM_URL or the OpenAI API URL. Because this component handles trust-review data, it may transmit sensitive user content and stored memory off-host without strong endpoint allowlisting, minimization, or explicit consent, creating a real confidentiality and data-exfiltration risk.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: This file stores extensive raw user queries, threat classifications, health-related prompts, security-testing prompts, and detailed planning artifacts that go well beyond minimal trust-gating metadata. In a trust/guard skill, such overcollection materially increases privacy exposure, expands the blast radius of compromise, and creates a secondary knowledge base of sensitive or hazardous requests that could be misused if accessed by other components or operators.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The file retains numerous sensitive and high-risk conversation records, including medical sedation requests, identity-document related requests, prompt-injection attempts, and security/CTF targeting prompts. Even when some items were blocked, preserving full-text content and detailed derived analysis can leak user intent, expose sensitive categories of data, and provide attackers or insiders with a curated corpus of harmful prompts and defense behavior.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The workflow documents persistent storage of user questions, plans, execution traces, and final answers in local files without any notice, consent, minimization, retention, or redaction guidance. Because these fields can contain secrets, personal data, credentials, or sensitive operational details, automatic logging creates a clear privacy and data-exposure risk if the files are accessed, reused in prompts, or retained indefinitely.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The documentation explicitly instructs users to store question, plan, execution, and feedback data in persistent local files, but it does not clearly warn that these inputs will be retained or describe retention expectations. This is dangerous because users may provide sensitive prompts or operational details without realizing they are being written to disk in memory.jsonl, feedback.jsonl, and trust_experience.json, increasing privacy and data exposure risk.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill instructs users to configure an external planner API endpoint and API key, but it does not warn that user questions and planning content may be transmitted to a remote service. This creates a data-handling risk because prompts may contain confidential information, and users may unknowingly send that information to third-party infrastructure with different logging, retention, or jurisdictional practices.

Missing User Warnings

Medium

Confidence: 80% confidence
Finding: The script persists user-supplied memory records to a local JSONL file without any explicit warning, consent flow, retention notice, or sensitivity checks. In an assistant-memory context, inputs may contain private prompts, personal data, or secrets, so silent persistence increases the risk of unintended local data exposure and long-term retention.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The code sends the raw question and optional reference plan to a remote endpoint, which may be OpenAI or an arbitrary custom URL, without any user-visible warning or consent flow. In this skill context, historical plans may contain sensitive prior task data, so silent transmission increases privacy and confidentiality risk beyond normal planning behavior.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The script persistently stores the raw user question, generated plan, and evaluation result to a local memory file without any visible consent, notice, minimization, or retention controls. If users provide secrets, personal data, or sensitive operational requests, those data are silently retained and may later be exposed to other components, users, backups, or logs. In a memory-oriented skill this behavior is contextually expected, but that same context increases the sensitivity of undisclosed retention.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The code sends prompts containing user queries, plans, and memories to the configured chat endpoint in callLLM without any user-visible disclosure at the time of transmission. In a trust/memory pipeline, these inputs can be sensitive, so silent network forwarding undermines privacy expectations and can expose confidential data to third-party services.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: run.mjs:53

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: planner/mia-planner.mjs:11

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: trust/mia-trust.mjs:11