Security audit

prompt-archaeology

Security checks across malware telemetry and agentic risk

Overview

The skill is purpose-aligned, but it needs Review because it searches private session history and uses an unsafe pickle-based index loader.

Install only if you are comfortable letting the agent search the chosen session-log or notes directories. Search only data you are authorized to process, avoid directories likely to contain credentials or personal data, and do not open index files from other people unless the index format is changed away from pickle or an explicit trusted-only warning and opt-in unsafe path are added.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill explicitly directs the agent to crawl local session logs, markdown files, and exported transcripts via `scripts/excavate.py`, which is a file-read capability, but the skill metadata does not declare corresponding permissions. That mismatch is dangerous because it obscures the data access the skill expects, reducing operator visibility and increasing the chance the skill is used to read sensitive local history or notes without adequate review.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: `ArchaeologyIndex.load()` uses `pickle.load()` on a user-supplied index file. Pickle deserialization is code-executing by design, so a malicious `.pkl`/index file can run arbitrary Python during `query`, which is far more dangerous than the tool's stated purpose of searching session history. In this skill context, users are encouraged to load reusable indexes, making untrusted-file loading a realistic attack path.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The README explicitly promotes crawling session logs, markdown files, and prior conversation history, which commonly contain secrets, personal data, tokens, and internal code. There is no warning, consent guidance, redaction advice, or safe-handling note, so users may unintentionally ingest and surface sensitive data into search results or downstream agent outputs.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill is centered on mining prior conversation sessions, exported logs, markdown notes, and even "another agent's transcripts," but it only includes a narrow caution about other users' private profiles and does not prominently warn that historical chats may contain secrets, credentials, personal data, or confidential business context. This creates a realistic privacy risk: the skill normalizes broad retrieval and extraction from historical transcripts without requiring consent checks, minimization, or redaction before surfacing artifacts.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: Loading a serialized pickle file without any trust warning is dangerous because the format itself is unsafe for untrusted input. The absence of a warning compounds the deserialization issue by making it more likely that users will open attacker-supplied index files, especially in a tool centered on importing and querying archived session artifacts.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.