Security audit

Data Labeler

Security checks for vulnerabilities and agentic risk

Overview

This package is presented as Label Studio but actually installs a local command-line logger that stores arbitrary user inputs under the user's home directory.

Review before installing. Treat this as a local plaintext activity logger, not as Label Studio. Do not pass sensitive datasets, customer records, credentials, or private prompts unless you are comfortable with them being stored under `~/.local/share/data-labeler/` and later surfaced by search or recent-history commands.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill metadata and description claim this is Label Studio, a standardized annotation tool, but the documented behavior is a generic Bash-based local logging utility that records arbitrary inputs and exports internal logs. This mismatch is dangerous because users and downstream agents may grant the skill inappropriate trust, use it in the wrong workflows, or pass sensitive dataset content expecting annotation processing rather than plaintext local persistence.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The script’s documented behavior and command surface implement a generic local data toolkit rather than a Label Studio annotation integration. That mismatch is dangerous because users may grant trust and permissions based on the manifest while actually installing a broader data collection and persistence utility with unrelated capabilities.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill says all operations are logged and stored locally, but it does not prominently warn that arbitrary user-provided inputs may be persisted in plaintext-like log and export files under the user's home directory. In a data-labeling context, inputs may include sensitive records, queries, schema details, or customer data, so silent local retention increases the risk of inadvertent disclosure through shared machines, backups, exports, or later searches.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The inline identity explicitly describes a generic 'Data Labeler' and 'data toolkit,' directly contradicting the manifest’s Label Studio branding. This inconsistency is a strong indicator of deceptive or poorly governed packaging, making it easier to smuggle unexpected functionality into a trusted ecosystem listing.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script creates a persistent data directory and history log for user activity without any privacy notice, consent flow, or retention policy. Because the tool accepts arbitrary text inputs, this can silently retain sensitive operational or personal data on disk longer than users expect.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: User-provided content is logged and then made retrievable through search, recent, status, and export features, enabling easy resurfacing and broad disclosure of previously entered data. In a mislabeled skill, this is more dangerous because users may not realize their inputs are being archived and re-exposed through convenience commands.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The exposed commands include broad data-processing functions such as pipeline, profile, aggregate, and schema that are not justified by the claimed Label Studio purpose. Excess capability increases attack surface and can be used to normalize collection and manipulation of local data under a misleading, narrower trust boundary.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Across many commands, arbitrary user input is written verbatim to persistent local log files, which exceeds the expected scope of an annotation tool. In the skill context, this creates unexpected data retention and collection behavior that can capture sensitive prompts, file names, or operational details without clear user understanding.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.