Security audit

temporal-agent-plugin

Security checks for vulnerabilities and agentic risk

Overview

The core timing features look legitimate, but the package includes an unrelated archive-unpacking script and under-disclosed location lookup that users should review before installing.

Review before installing. The temporal-analysis code is mostly coherent, but avoid running process_base64_zip.py unless you intentionally need it and trust the input archive. Use an isolated environment with pinned dependencies, document or disable external location lookup, and do not expose the API server beyond trusted networks.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: This file implements Base64 decoding, ZIP validation, extraction, and raw file writing, which is unrelated to the declared temporal-awareness purpose of the skill. In an agent/plugin context, hidden file unpacking capability is dangerous because it expands the attack surface and can be used to stage arbitrary content or payloads under the guise of an unrelated skill.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The code extracts attacker-controlled ZIP contents directly to disk via extractall(output_dir) and also writes decoded arbitrary bytes to a file when the content is not a ZIP. This provides unjustified filesystem write capability in a skill that should only provide timing-related functions, and the ZIP extraction path is especially risky because archive members may perform path traversal or overwrite files depending on runtime behavior and environment.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The component initializes a geocoder client, enabling outbound network access in a module whose stated purpose is local time awareness and prompt time anchoring. Even though the lookup is only used later, this broadens the skill's capability surface and can lead to unexpected data egress or policy bypass in environments that assume the skill is purely local and non-networked.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The get_timezone_by_location function accepts user-supplied location text and resolves it through an external geocoding service, which exceeds the advertised timing/perception scope. In an agent setting, this can silently transmit sensitive user context such as city or place names to a third party and create functionality that operators may not expect or permit.

Vague Triggers

Medium

Confidence: 77% confidence
Finding: The invocation description is broad enough to match many generic AI tasks, increasing the chance the skill is auto-selected outside its intended scope. Overbroad activation is risky here because the skill appears to have capabilities beyond simple temporal analysis, so accidental invocation could trigger unnecessary network, file, or system-level operations in unrelated contexts.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: This line sends user-provided location data to an external geocoding service without any visible consent, notice, or minimization. In a conversational agent, location strings can be personal data, so silent transmission creates a privacy risk and may violate user expectations or deployment policies.

Static analysis

No suspicious patterns detected.