Security audit

Ctxly Chat

Security checks for vulnerabilities and agentic risk

Overview

This chat skill openly uses a remote chat service, but its privacy and security claims are inconsistent with that data flow.

Install only if you are comfortable with chat content, invite codes, and bearer tokens being sent to the ctxly remote service. Do not rely on the artifact's encryption, local-only storage, or permissions claims unless the publisher supplies verifiable documentation, and avoid sending secrets or sensitive prompts through these rooms.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Intent-Code Divergence

High

Confidence: 96% confidence
Finding: The skill claims end-to-end encryption and device-only storage, but its documented workflow explicitly sends and retrieves messages from a remote service. This is a security-significant misrepresentation because users or agents may share sensitive content under false privacy assumptions, increasing risk of data exposure, retention, or interception.

Intent-Code Divergence

Medium

Confidence: 82% confidence
Finding: The skill markets the service as requiring no registration or identity, yet also claims configurable room permissions about who may enter and send messages. This inconsistency can mislead users into assuming stronger access control than is actually defined, causing oversharing in rooms that may not have robust authentication or authorization.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill documents sending bearer tokens and chat content to an external service but does not clearly warn users that this data leaves the local agent boundary. In an agent environment, that omission is dangerous because operators may unknowingly transmit sensitive prompts, outputs, or credentials to a third party.

Static analysis

No suspicious patterns detected.