Security audit

Observability

Security checks across malware telemetry and agentic risk

Overview

This is a coherent observability skill, but it can persist and expose sensitive agent telemetry through unauthenticated local APIs and logs without enough scoping or privacy guidance.

Install only if you are comfortable with a local observability service that writes logs by default and exposes telemetry APIs without built-in authentication. Run it bound to localhost or behind access control, disable file logging or debug logging when handling secrets, avoid passing prompts/tokens/raw payloads into trace metadata, and configure webhooks only to trusted endpoints.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The dashboard builds log entries with string concatenation and assigns them to innerHTML using unescaped log.message/log.raw values. If any attacker-controlled input reaches the logs, visiting the dashboard can trigger stored XSS in the browser of anyone viewing the page, which is especially dangerous in an observability tool that may be used by privileged operators.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill explicitly documents monitoring of LLM, MCP, and A2A activity plus dashboard/API exposure, but it does not warn that prompts, payloads, file paths, session identifiers, tokens, and other operational metadata may contain sensitive data. In an agent environment, this can lead to inadvertent collection and disclosure of secrets or private user content through logs, metrics, traces, or unauthenticated local dashboards.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The webhook handler transmits alert and rule data to an arbitrary configured URL, which can expose operational metadata, metric values, rule names, thresholds, and potentially sensitive environment details to external systems. In an agent/runtime context, this is risky because the destination is fully configurable and there is no validation, allowlist, redaction, or explicit consent mechanism around outbound network exfiltration.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The server exposes recent logs at /api/logs with no authentication, authorization, or access restriction visible in this file. Logs often contain sensitive operational details, user data, tokens, prompts, stack traces, or internal paths, so unauthenticated access can leak information useful for follow-on attacks.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The code logs `...options` directly in `startCall()`, which can expose prompts, system instructions, API parameters, user content, or other sensitive request metadata to debug logs. In an LLM monitoring component, those options frequently contain high-sensitivity data, and logs are often broadly retained or accessible, making this a realistic confidentiality risk.

Missing User Warnings

Medium

Confidence: 81% confidence
Finding: The logger writes structured application data to local files by default, and the logged metadata may include request context or other sensitive fields supplied by callers. In a skill/agent environment, persistent logs can retain secrets, user content, or internal state on disk where they may be accessible to other processes, backups, or later forensic access.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: On error, the wrapper logs both error.message and error.stack along with arbitrary metadata, which can expose secrets, tokens, file paths, query contents, or user data embedded in exceptions. In this context, the logger is designed for broad observability and accepts caller-controlled metadata, making accidental sensitive-data capture more likely and increasing the risk of information disclosure through logs.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The tracer accepts arbitrary context and stores it as span tags, then logs that context at trace start. In an observability component, callers may pass secrets, tokens, prompts, user data, or other sensitive fields, and this implementation provides no filtering, redaction, or data classification before retention and logging.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: setError captures and stores full error messages and stack traces, which often include filesystem paths, internal implementation details, query fragments, secrets embedded in exception text, or user data. If traces are exported or exposed to logs or dashboards, this can leak diagnostic data beyond its intended audience.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: exportTrace returns the complete trace payload, including tags, logs, and captured errors, with no sanitization or access control in this component. Because the tracer also records arbitrary context and stack traces, this export path becomes a straightforward data exfiltration surface for sensitive operational or user information.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: src/dashboard.js:516