Security audit

Syberz Chatflow Guardian

Security checks for vulnerabilities and agentic risk

Overview

The skill is not clearly malicious, but it combines broad conversation profiling with an installer that can create a persistent system-level service without a clear opt-in prompt.

Review before installing. Treat this as a persistent local service, not a simple chat helper. Install only if you are comfortable with local logging, behavioral prediction features, and system service setup; disable training, learning, platform broadcasting, and systemd installation unless you explicitly need them.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (63)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill declares no permissions, yet the documentation instructs users to run shell commands for installation, testing, deployment, and service management. This creates a trust boundary mismatch: operators may approve the skill as low-risk while it actually relies on command execution and host-level changes, increasing the chance of unauthorized or unexpected system modification.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documented purpose is simple conversation continuity, but the described behavior expands into cross-platform messaging, predictive profiling, local logging, model optimization, and deployment persistence. This mismatch is dangerous because users may consent to a narrow communication aid while the skill can process historical data, send unsolicited messages across platforms, and install persistent components beyond the stated scope.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The screenshot specification markets capabilities such as intent recognition, predictive analytics, deep learning models, broad multi-platform integrations, and broadcast behavior that substantially exceed the stated purpose of merely preventing conversations from ending. This is dangerous because it can misrepresent the skill's actual behavior and encourage reviewers or users to trust undocumented data processing, monitoring, and cross-platform messaging features that may carry privacy, consent, and security implications.

Intent-Code Divergence

Low

Confidence: 81% confidence
Finding: The file instructs creators to show 'real functionality' while simultaneously providing fabricated mockup content for advanced features, creating a misleading presentation risk. Although this is more of an integrity and trust issue than a direct exploit primitive, it can deceive marketplace reviewers and users about the security posture and maturity of the skill.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The skill’s stated purpose is simple conversation continuity monitoring, but the configuration enables substantially broader user profiling, including preference learning, schedule learning, predictive history analysis, and deep-learning-based behavior modeling. This creates unnecessary collection and inference of sensitive behavioral data beyond the declared function, increasing privacy and misuse risk if the data is accessed, retained, or repurposed.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: Emotion analysis and user-behavior prediction are highly invasive capabilities that are not necessary to ensure a user message is not the last in a conversation. These features can infer sensitive psychological or behavioral attributes, expanding the privacy impact well beyond the advertised functionality and making abuse or silent profiling materially more dangerous.

Context-Inappropriate Capability

Low

Confidence: 80% confidence
Finding: Supporting many external messaging platforms broadens the data exposure surface, credential footprint, and integration risk beyond what is needed for a narrowly described chat continuity tool. While not inherently malicious, this mismatch increases the chance of over-privileged deployment and accidental collection or transmission across services the user did not expect.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: This test script exercises broad ML capabilities—intent enhancement, user behavior prediction, conversation analytics, and training—that materially exceed the stated skill purpose of merely ensuring the user is not the last speaker. In a skill context, such scope creep is dangerous because it enables collection and inference over user data beyond user expectations, increasing privacy and misuse risk.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The code predicts a user's next action from interaction history, which is behavioral profiling unrelated to preventing a conversation from ending. This creates unnecessary privacy risk and can support covert user modeling without clear user need or informed consent.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The script collects training data including message content, intent labels, confidence, response time, context, and a user identifier for model training, none of which is necessary for the declared guardian behavior. This broadens data retention and model-training risk, especially if test code patterns are reused in production.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The file header describes a deep-learning optimization test module that conflicts with the manifest's simple conversation-guardian purpose, indicating undeclared functionality. Such contradictions are risky because they can conceal capabilities that reviewers and users would not reasonably expect.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The demo showcases cross-platform messaging, broadcasting, and platform initialization capabilities that materially exceed the stated skill purpose of merely ensuring a conversation does not end. Even in demo code, this normalizes a broader operational scope and may mask undeclared capabilities that can send messages to external platforms or expand data flow beyond user expectations.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The code records detailed user interaction history, derives user statistics, and generates predictions about future behavior, which constitutes profiling beyond the narrow purpose of keeping conversations active. This creates unnecessary privacy risk, expands retained personal data, and could enable behavioral inference without a clear need, notice, or consent.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: Multi-platform outbound messaging and broadcast features are unrelated to the stated guardian-style monitoring purpose and increase the risk of unauthorized message propagation across services. In context, a skill that is expected to monitor a conversation locally becomes more dangerous when it can actively transmit or broadcast content to multiple external destinations.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The installer creates a persistent systemd service for continuous background execution, which materially expands the skill's operational scope beyond a simple chat-state helper. Persistence is security-relevant because it causes code to run automatically over time and survive user logout/reboots, increasing the blast radius if the skill is buggy or later compromised.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: Writing a service file under `/etc/systemd/system` is a host-level configuration change that requires elevated privileges and grants the skill a path to long-lived execution. That capability is not justified by the stated purpose of monitoring conversation state, so it represents unnecessary privilege expansion and increases the risk of unauthorized persistence on the host.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The test file and its output present the skill as a simple conversation-continuity guard, but the code validates a much broader system with predictive profiling, deep-learning intent recognition, and multi-platform orchestration. This mismatch is dangerous because it can conceal expanded capabilities from reviewers and users, leading to deployment of functionality that exceeds the declared purpose and trust boundary of the skill.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: This code records per-user interaction data, including userId, message, intent, responseTime, and timestamp, to support predictive behavior analysis even though the skill is described only as preventing conversations from ending. Collecting and profiling behavioral data outside the stated purpose creates an unjustified privacy and scope-expansion risk, especially if reused across sessions or platforms.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The file behavior and self-description materially expand the skill from a narrow conversation guard into a general dialogue-management platform with profiling and ML-driven features. In the skill context, this makes the package more dangerous because reviewers may approve it for a limited purpose while it actually introduces broader data handling, inference, and integration surfaces.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The file implements broad ML analytics, model management, user-behavior prediction, emotion analysis, and conversation-quality scoring that materially exceed the stated skill purpose of merely preventing conversations from ending. This kind of capability mismatch is dangerous because it hides expanded data processing and inference behavior from users and reviewers, increasing the risk of unauthorized profiling and privacy-invasive functionality.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The code collects per-user interaction records including userId, message, inferred features, context, timestamps, and correctness labels, then uses them for model training and behavior prediction without any evident necessity tied to the declared purpose. This creates a profiling surface that can expose sensitive behavioral patterns and enable persistent tracking beyond what users would reasonably expect from a conversation-guarding skill.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: Emotion analysis and conversation-quality scoring are extra inference capabilities not justified by the skill's stated role. Even if simulated here, these functions normalize collecting affective and evaluative signals about users, which can lead to privacy overreach and undisclosed secondary processing.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The module header explicitly advertises deep-learning intent recognition and user behavior prediction, which conflicts with the manifest description of maintaining conversation continuity. This discrepancy is a security concern because misleading metadata can conceal risky processing from reviewers and users, undermining trust and informed consent.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The implementation materially exceeds the stated purpose of merely keeping conversations from stalling by introducing cross-platform integration, predictive behavior analysis, and deep-learning features. This scope expansion is dangerous because it increases data access and behavioral profiling capability beyond user expectations, undermining informed consent and least-privilege design.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The code collects training data containing user IDs, full messages, context, timestamps, and inferred intent for model improvement, which is far broader than necessary to keep a conversation active. This creates a clear privacy and surveillance risk because sensitive conversational content is tied to identifiable users and may be retained or reused without a demonstrated need.

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

Code: suspicious.destructive_delete_command
Location: QUICKSTART.md:205