Security audit

Xiang miles | Space2.world

Security checks across malware telemetry and agentic risk

Overview

This skill is openly designed to read local chat logs and keep adding them to persistent agent memory, which needs careful review before use.

Install only if you intentionally want this skill to copy local chat logs into S2-OS persistent memory. Use a dedicated log folder, inspect `hippocampus_logs.json` before and after runs, avoid heartbeat scheduling until you are comfortable with the behavior, and do not place sensitive chats, secrets, or proprietary material in the watched log directory.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: The skill explicitly presents itself as an automatic chat eavesdropper and the surrounding code confirms that behavior by scanning chat logs and transferring their contents into a separate persistent memory store. This creates covert collection of potentially sensitive user and agent conversations without any consent, notice, access control, or data minimization.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The manifest describes the skill as passively scanning local chat logs without defining explicit user triggers, scope limits, or consent boundaries. Broad passive-activation language is dangerous because it normalizes background access to sensitive local data and increases the chance of unauthorized or unexpected collection.

Missing User Warnings

High

Confidence: 99% confidence
Finding: This code reads chat log files incrementally and writes summarized contents into another persistent file, effectively exfiltrating conversation data into a second datastore. Because there is no user warning, consent flow, purpose limitation, or validation of what is being copied, sensitive prompts, credentials, personal data, or proprietary information may be silently retained and exposed.

Natural-Language Policy Violations

High

Confidence: 98% confidence
Finding: The string describing the tool as an automatic chat eavesdropper is a strong indicator of covert monitoring intent, especially because the implementation actually reads conversation logs and persists them elsewhere. In this context, the language is not merely decorative; it accurately signals privacy-invasive behavior that could be used for surveillance or unauthorized data harvesting.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The skill explicitly advertises silent crawling of agent chat logs and automated memory injection into persistent storage without indicating any runtime notice, consent, or user control. Even if the data stays local, this creates covert persistence of potentially sensitive conversations and increases the chance of privacy violations, cross-session data leakage, and unintended retention of secrets.

Ssd 3

Medium

Confidence: 97% confidence
Finding: This section directs automatic appending of chat-derived session chunks into a persistent 'hippocampus' log for later personality or behavior processing. Persisting conversational content for downstream automated use is dangerous because it can preserve secrets, personal data, or prompt material beyond the original session and influence future agent behavior in ways the user did not authorize.

Ssd 3

High

Confidence: 97% confidence
Finding: The description explicitly states that the skill passively scans local chat logs, chunks conversations, and injects them into an internal memory buffer. This indicates unauthorized collection and internal propagation of highly sensitive personal data, which could expose private conversations, credentials, or secrets and create a durable surveillance channel inside the host environment.

Ssd 3

High

Confidence: 99% confidence
Finding: The natural-language comments and banner text describe covert collection and storage of chat logs, and the rest of the file operationalizes that design by monitoring a log directory and injecting captured text into a separate 'hippocampus' file. The context makes this more dangerous because it is framed as a hidden hook and memory injection system rather than a transparent logging utility.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.