MaskClaw: Evolutionary Personalized Privacy Guard

• Outcome: Review
• Latest audit: May 29, 2026 · 9:30 PM UTC
• Version: 1.0.0

Overview

This privacy skill is coherent but needs review because it stores sensitive behavior/image data and can automatically publish generated active rules.

Install only after reviewing whether you are comfortable with a privacy tool that records detailed local behavior traces, sends trace-derived prompts to a local model endpoint, prints OCR text unless changed, and can generate active per-user skills. Require explicit opt-in, disable raw OCR/content logging, add retention/deletion and encryption controls, and make generated-rule publication require human approval before activation.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (18)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill advertises capabilities consistent with file read/write, local model/MCP access, and network use, but declares no explicit permissions or trust boundaries. In a privacy/security-focused skill, this creates hidden authority that can enable silent data exfiltration, unauthorized local file access, or unsafe downstream tool invocation without informed review.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The design explicitly extends from learning privacy rules into an autonomous pipeline that mutates, tests, and publishes generated artifacts into `user_skills/`. That crosses a major trust boundary: behavior-derived data can influence deployable skill logic, creating a path for unintended or unsafe code/prompt behavior to be materialized and later executed without strong human review.

Intent-Code Divergence

Medium

• Confidence: 87% confidence
• Finding: The document presents the feature as privacy-rule refinement, but later describes SOP mutation, iterative optimization, sandboxing, and publishing skills. This mismatch is dangerous because it obscures the real capability scope from reviewers and operators, increasing the chance that a rule-learning subsystem is granted permissions suitable for low-risk data processing while actually acting as an autonomous skill-generation pipeline.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: This module goes beyond passive privacy protection and autonomously generates and publishes new skills to disk and a registry. In a privacy-focused skill, self-modifying and self-publishing behavior materially expands capability and attack surface, especially because generated content can later influence agent behavior without strong human approval in the same path.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The analysis prompt includes failed scenarios and correction summaries derived from session traces, then sends them to an HTTP-served model endpoint. That creates a direct privacy exposure path for potentially sensitive user behavior and correction data, which is especially serious given the product claims privacy protection.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The exception path claims all publish operations were rolled back, but only the created directory is deleted. Database writes, processed-trace state changes, catalog updates, or notifications may already have occurred, leaving inconsistent state that can misrepresent what was published or suppress future processing of traces.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The Behavior Monitor is described as continuously listening to agent actions and logging user interventions, including contextual fields such as scenario tags and PII types, but the documentation does not clearly warn users that this data is being collected and stored. This can lead to covert monitoring, privacy-law compliance issues, and retention of sensitive behavioral metadata that may itself become a target.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The self-evolution workflow explicitly includes sandbox testing followed by automatic publish/auto-mount behavior, yet the skill does not clearly warn about the system-integrity risks of deploying self-modified rules. A flawed or poisoned evolution step could weaken protections, introduce unsafe logic, or change enforcement behavior without meaningful human approval.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The document explicitly defines a protocol that forwards a masked image plus metadata such as source_app, timestamp, applied rules, judgment, confidence, and sensitive_regions to a cloud agent, but it does not describe explicit user notice, consent, minimization, or controls over this transfer. In a privacy-protection system, undocumented or non-consensual transmission of even partially sanitized data increases the risk of residual sensitive data leakage, profiling, and unexpected cross-context exposure if masking is incomplete or metadata is identifying.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The design calls for real-time collection of user behavior and correction signals as core telemetry, yet provides no user notice, consent, or clear privacy controls. In a privacy-protection product, silent capture of sensitive interaction data is especially risky because users are likely to trust the system with highly sensitive contexts and may not expect persistent logging.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: Logged correction data is sent to a local model endpoint over HTTP for processing, but the design omits transparency and safeguards around that transfer. Even on localhost, this expands exposure of sensitive data to another service/process boundary, where it may be logged, intercepted by local malware, or processed beyond the user's expectations.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The sample schema stores user identifiers, timestamps, app context, addresses, and medical-record-related previews, but does not specify minimization, encryption, retention, or masking requirements. This creates a concentrated sensitive-data store that could expose intimate user activity and regulated data if accessed by other users, processes, or attackers.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The logger persists per-user identifiers and action/correction data to disk under predictable paths, which can expose sensitive behavioral and privacy-related data if local files are accessed by other processes, users, backups, or support tooling. In a privacy-protection skill, collecting and storing user behavior without explicit consent/notice and without visible access controls materially increases privacy risk and undermines the skill's stated purpose.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: Structured session traces store linked behavior chains, app context, field names, inferred PII types, relationship tags, agent intent, and possible correction values, creating a rich audit trail that can reveal highly sensitive user activity. Because this skill is specifically marketed as endpoint privacy protection, silent persistence of such detailed traces is more dangerous: compromise or misuse of these files would directly expose the very private behaviors the skill is supposed to protect.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: Full prompts containing embedded user trace content are transmitted to the model service with no visible disclosure or consent mechanism in this code path. For a privacy-oriented skill, silent export of behavioral and correction context is a significant privacy and compliance risk.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The publish path writes generated skills and catalog files to disk automatically, with only a post-hoc notification rather than prior confirmation. In a system that can alter future agent behavior, silent persistence and activation of generated rules can surprise users and create unsafe or undesired automation.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The code prints all OCR-recognized text from the image directly to stdout, which can expose exactly the sensitive information the module is supposed to protect. In a privacy-focused masking skill, this is especially dangerous because logs, terminals, CI output, or centralized log collectors may retain names, IDs, addresses, or other secrets even after the output image is masked.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The prompt explicitly instructs the model to infer what the user 'really cares about' from raw correction data pulled from traces. That is a sensitive profiling behavior using behavioral telemetry, and in this context it increases privacy risk and the chance of over-collection or secondary use of user data.

VirusTotal

61/61 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.