Security audit

ima.plus-skill-v1.0.3

Security checks across malware telemetry and agentic risk

Overview

This appears to be a real IMA notes and knowledge-base integration, but it needs review because its credential handling and automatic update/persistence behavior are broader than its security metadata admits.

Install only if you trust this skill with your IMA notes, knowledge bases, and API key. Prefer environment variables or a protected secret store over config.json, review any bulk export or permission-change request before approving it, and be aware the wrapper performs automatic update checks and writes state to config.json.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (12)

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The skill’s security metadata claims credentials are only sent to official endpoints and not stored elsewhere, but later documentation explicitly supports reading credentials from local files such as config.json and ~/.config/ima/. This is a documentation-integrity issue: operators may make trust decisions based on false assurances about secret storage and handling.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The text states that credentials are not written to files, yet the setup instructions recommend placing API secrets in config.json. This contradiction can mislead users into adopting weaker secret-management practices under the false belief that no file-based persistence occurs.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: This later security note repeats the inaccurate claim that credentials are never written to external files, despite earlier instructions to store them in config.json and support for ~/.config/ima/. Repetition increases the likelihood that users and reviewers will trust an incorrect security property and overlook local secret exposure paths.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The wrapper pulls API credentials from multiple implicit sources, including environment variables and files under the user's home directory, even though the skill's stated purpose is note-management operations. This expands the skill's access to local secrets and makes it easier for the skill to use credentials without explicit user awareness or per-invocation consent; in an agent setting, that is a real secret-handling risk.

Description-Behavior Mismatch

Low

Confidence: 86% confidence
Finding: The code performs an autonomous update check against a remote endpoint and persists local state in config.json, behavior that is not part of the manifest's described note-management functionality. Hidden network activity and undeclared persistence reduce transparency and create an unexpected control channel that can influence runtime behavior or leak metadata such as version and usage cadence.

Description-Behavior Mismatch

High

Confidence: 94% confidence
Finding: The front-matter description understates the skill's capabilities: although it claims to handle upload/add/search/browse/get-info, the body documents many additional state-changing and data-moving actions such as export, permission changes, joins, moves, renames, and tag operations. This mismatch can mislead reviewers or orchestration layers about the skill's effective privilege scope, increasing the risk of unsafe invocation and inadequate approval gating.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The zip-export section introduces bulk export and delivery of knowledge-base contents, but this capability is not reflected in the module description. Hidden or weakly disclosed export functionality is dangerous because it enables mass exfiltration of potentially sensitive documents under a skill that may be perceived as only performing routine knowledge-base management.

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: The script performs a state-changing remote API call to join a knowledge base immediately after parsing CLI arguments, with no interactive confirmation, dry-run mode, or stronger warning beyond a log message. In an agent-skill context that can be invoked programmatically, this increases the risk of unintended membership changes, social-engineering-driven execution, or accidental joins to attacker-controlled knowledge bases.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger guidance for note search uses very broad natural-language phrases such as '搜索' or '找笔记' without any disambiguation or exclusion criteria. In an agent setting, this can cause the skill to activate on ambiguous conversational text and perform privacy-sensitive note retrieval when the user did not clearly intend a note search.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The create/import trigger phrases include generic commands like '新建笔记', '导入笔记', and especially '把这段内容保存为笔记', which can map ordinary conversational context directly into a persistent write action. Without an explicit confirmation step, the agent could unintentionally create notes from transient or sensitive user messages, resulting in unauthorized persistence or data mishandling.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The documentation describes write-capable endpoints for creating and appending note content but does not instruct the agent to warn the user that these actions will modify persistent personal data. In a privacy-sensitive notes skill, lack of an explicit modification warning and confirmation increases the risk of accidental writes, overwrites-by-append, and storing sensitive content the user did not intend to retain.

Ssd 3

Medium

Confidence: 92% confidence
Finding: The documented workflow supports recursive whole-library export, zipping, and subsequent file delivery to the user. In a knowledge-base context, that materially increases the chance of bulk disclosure of sensitive or proprietary data, especially if user identity, authorization scope, or export intent is not independently verified by the calling system.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: knowledge-base/scripts/export_kb_zip.cjs:199

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: knowledge-base/scripts/upload_to_kb.cjs:74

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: ima_api.cjs:42

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: knowledge-base/scripts/export_kb_zip.cjs:61