Security audit

Hf Pub

Security checks across malware telemetry and agentic risk

Overview

This skill is a local rule-based text checker with disclosed local memory features and no evidence of network exfiltration or install-time execution, though its metadata is broader than the shipped code.

Install only if you are comfortable with a local rule-based validator that may retain correction snippets and generated rules in local JSON files when its memory APIs are used. Do not treat it as a strict safety boundary or production moderation system without additional review, and be aware that the package metadata includes stale or broader workflow labels than the shipped artifact appears to implement.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill is presented as a narrow, rule-based validator with 'zero LLM dependency,' but the described pipeline and analyzer findings indicate substantially broader behavior, including rewriting, verification helpers, persistent memory, auto-rules, and larger-system hooks. This hidden scope expansion is dangerous because users may grant trust and integrate the package as a simple validator while it performs stateful or policy-shaping actions that affect outputs across sessions and may store or transform sensitive content unexpectedly.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The manifest presents the package as a narrow, rule-based text validation engine, but the declared workflows and features extend into broader agentic behaviors such as debugging, upgrading, session context, and prompt-related processing. This scope mismatch is dangerous because integrators may grant trust and permissions based on the safer description while the package exposes higher-risk operational surfaces than advertised.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: Capabilities such as system-prompt absorption, dreaming, session context, memory scoring, and signal tracking are not justified by a simple rule-based validation use case and materially expand the attack surface. In a skill ecosystem, such hidden or weakly explained features can enable prompt harvesting, context retention, or behavior shaping beyond user expectations, making misuse and privilege overreach more likely.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: This module creates and maintains a persistent cross-session file-backed memory store even though the skill is described as a rule-based text discrimination engine with no indication of long-term state retention. Undisclosed persistence expands the data boundary, introduces privacy and compliance risk, and can retain sensitive prompts or derived behavior data longer than users would reasonably expect.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: logCorrection stores detail and up to 200 characters of context on disk for future sessions, which can capture user text, prompts, or sensitive fragments without necessity for core validation behavior. Cross-session retention of contextual text increases exposure in the event of local compromise, accidental inclusion in packages/backups, or later unintended reuse.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The scope checker advertises and recognizes modification and research actions even though the skill is described as a text-discrimination validator. In a policy-gating component, overstating capability weakens trust boundaries: downstream components may permit requests to create, edit, delete, search, or query based on this classifier, enabling behavior outside the declared safety envelope.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The comments state that out-of-scope questions should not be answered, but the implementation returns pass:true for inputs that are not matched and merely flags them as uncertain. This fail-open behavior allows novel or paraphrased out-of-scope requests to bypass the pre-screen and reach later stages, undermining the intended safety control.

Natural-Language Policy Violations

Medium

Confidence: 84% confidence
Finding: Security warnings that are only in Chinese may not be understood by all users of a public npm package, especially given the global audience implied by the registry and English metadata. That creates a real safety and consent problem: users may miss warnings about high-risk sub-skills, network behavior, or credential handling and deploy the package under incorrect assumptions.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The code writes correction details and context to a local JSON file without any visible notice, consent flow, or API contract indicating that user-related text is being retained. Silent persistence is dangerous because operators may deploy the skill assuming transient processing while the component actually creates an audit-like corpus of prior interactions.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.