Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed profile-sync client, but it can upload service-selected files from the user's home directory and creates local config despite only declaring read and network permissions.
Review this carefully before installing. It is not evidence of malware, but it allows a sync service manifest to choose a home-directory file for upload, and common profile files can contain secrets. Only use it with a sync service you trust, and prefer a version that previews or allowlists synced paths and declares its config-file write permission explicitly.
The skill requests filesystem read and network-related capabilities for a profile sync workflow, but the documented behavior is inconsistent about where data goes and who actually transmits it. That mismatch undermines informed consent and makes it harder for users or reviewers to understand that local files may be collected and sent off-host, which can conceal privacy-sensitive data flows.
The code has undeclared file-write capability via --init, creating ~/.config//config.json despite the skill declaring only filesystem:read and network:egress. Undeclared capabilities are dangerous because they bypass the stated trust boundary and can mislead reviewers and users about what the skill is allowed to modify locally.
The code performs local filesystem writes even though declared permissions only allow filesystem:read and network:egress. This permission mismatch is security-relevant because it means the implementation exceeds the reviewed access model, undermining permission-based containment and user consent.
The skill description says it reads files from the user's home directory and uploads a snapshot to a sync service, but it does not give an explicit privacy warning or prompt about data transmission. Because profile files can contain sensitive personal or credential-adjacent information, silent or underexplained exfiltration to a service increases the risk of unintended disclosure.
The setup path writes a per-user configuration file even though the described purpose is only to sync files from a remote manifest to a service. While the written content is minimal, this hidden persistence expands behavior beyond the advertised scope and creates an unexpected local side effect.
Declared permissions with no matching code capability may indicate removed functionality or pre-staging for future abuse.
No suspicious patterns detected.
