Security audit

Note Process Engine Free

Security checks across malware telemetry and agentic risk

Overview

This note-analysis skill is mostly purpose-aligned, but its read-only claims conflict with documented create, modify, import, export, and save actions, so users should review it before installing.

Install only if you are comfortable giving the agent access to local research-note files and command execution for this workflow. Treat it as a review-needed skill until the publisher clarifies whether it is truly read-only, whether export/save/import/reset actions exist, and whether optional dependencies or external LLM processing are used.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

High

Confidence: 94% confidence
Finding: The skill claims operations are read-only and that the free edition does not modify or export data, but later documents create/modify/import/export/save actions via configurable parameters. This mismatch can cause an agent or user to authorize the skill under a false safety model, leading to unintended writes, data export, or broader execution than expected.

Intent-Code Divergence

Medium

Confidence: 83% confidence
Finding: The documentation says the skill is fully local with zero external dependencies, yet later states it requires an LLM API and may require jieba. This can mislead reviewers and users about data exposure, supply-chain risk, and runtime behavior, especially if sensitive notes are processed under the assumption they never leave the local environment.

Intent-Code Divergence

Medium

Confidence: 80% confidence
Finding: The free version is described as standard-library-only and zero-dependency, but Chinese support is elsewhere documented as relying on jieba. This inconsistency can cause unsafe deployment assumptions, unexpected package installation, or hidden expansion of the trust boundary in environments that require strict dependency control.

Vague Triggers

Medium

Confidence: 72% confidence
Finding: The trigger condition is overly broad, covering generic analysis, reporting, statistics, and visualization requests. In an agent setting, this can cause the skill to activate on unrelated user prompts and invoke read/exec-capable behavior without clear user intent, increasing the chance of unnecessary file access or command execution.

Vague Triggers

Medium

Confidence: 70% confidence
Finding: The capability coverage list is vague and built from generic keywords rather than precise scope limits. This makes it easier for an orchestrating agent to over-match normal requests to this skill, potentially causing unintended execution paths and access to local note data beyond what the user expected.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.