Clipboard Memory

• Outcome: Pass
• Latest audit: Jul 11, 2026 · 8:53 PM UTC
• Version: 1.3.8

Overview

This is a coherent local clipboard-history recall skill, but users should treat it as sensitive because clipboard history can contain private data.

Install only if you want an agent to query your local clipboard history. Clipboard archives can contain passwords, tokens, private messages, documents, images, and file paths, so ask for narrow searches and be careful with export, restore, delete, purge, settings, service, launch-at-login, and update-check commands.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: The skill is presented primarily as clipboard recall, but its instructions also authorize diagnostic probing of local service state, database health, watcher processes, and integration status. That broader host inspection increases the data and control surface beyond user-expected clipboard lookup, which can lead an agent to collect or expose system information without sufficiently explicit user consent.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The documentation expands from read-oriented clipboard recall into app settings changes, launch-at-login changes, update checks, quitting the app, and reset operations. Mixing retrieval with mutation/control capabilities makes it easier for an agent to perform state-changing actions the user did not specifically request, especially in ambiguous conversations.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill explicitly authorizes OS follow-through commands such as pbcopy, open, or open -R after archive queries. Those commands cross from bounded recall into system interaction and can overwrite the current clipboard or reveal files/apps, creating side effects outside the stated retrieval purpose.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The commands reference exposes broad destructive and configuration-mutating capabilities such as restore, export, forget, purge, settings changes, app preference changes, and OCR/storage workflows that go well beyond the manifest's stated purpose of recalling prior clipboard contents. In an agent setting, documenting these capabilities materially increases the chance the skill will be used to alter system state, delete user data, or exfiltrate clipboard-derived content under the guise of a retrieval skill.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: The documented `agents context` capability returns operational metadata including service health, settings, app state, recent activity metadata, revision, stats, privacy guidance, capabilities, app names, timestamps, counts, and paths. That exceeds simple clipboard recall and can leak environmental and usage metadata that may aid profiling, lateral discovery, or targeting even when raw clipboard bytes are excluded.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: `app update-check run` performs a live latest-stable-release lookup, introducing network activity unrelated to clipboard recall. For a local-memory retrieval skill, this expands the trust boundary from local-only access to external communication and creates an unnecessary channel for telemetry exposure, SSRF-style misuse in constrained environments, or policy violations around outbound access.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: Including agent skill install, print, and uninstall commands is unrelated to clipboard recall and grants the skill a pathway to modify the agent's own skill environment. This broadens the blast radius from data retrieval to self-modification and persistence management, which could be abused to plant, replace, or remove agent capabilities.

Context-Inappropriate Capability

High

• Confidence: 94% confidence
• Finding: Background service management commands such as start, stop, and uninstall are not justified for a retrieval-oriented clipboard-memory skill and allow the agent to alter capture persistence and service state. An attacker or faulty agent could disable evidence collection, change availability, or manipulate the monitoring lifecycle without the user understanding that a recall request can affect background processes.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Clipboard history is intrinsically sensitive and may contain passwords, tokens, private messages, financial data, or internal documents. The skill strongly encourages broad recall and archive searching but does not prominently warn that it is accessing a persistent history of everything copied, increasing the risk of over-collection or disclosure to the agent/user interface.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: Raw-byte export writes recovered clipboard contents, including images and PDFs, to disk and may persist sensitive material beyond the archive itself. Without a user-facing warning and safe-default handling, an agent could create new local copies of confidential data in predictable paths, increasing exposure and retention risk.

Missing User Warnings

Low

• Confidence: 79% confidence
• Finding: The documentation states that `app update-check run` performs a live release lookup but does not prominently warn that this causes outbound network access. In a tool presented as local clipboard memory, omission of that warning can mislead users and downstream agents into violating privacy expectations or network restrictions.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.