Security audit

Screen Activity Tracker Lite

Security checks across malware telemetry and agentic risk

Overview

This screen-tracking skill appears purpose-aligned, but it collects highly sensitive screen contents on a schedule and may send screenshots to a configured HTTP AI endpoint without sufficiently clear disclosure or consent controls.

Review this carefully before installing. Only use it if you are comfortable with periodic full-screen screenshots being stored locally and potentially analyzed through the configured HTTP model endpoint. Prefer a localhost-only endpoint, disable or remove remote analysis unless you explicitly trust it, confirm how to stop tracking and delete stored data, and avoid running it while sensitive windows are visible.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill manifest exposes capabilities consistent with file read/write and network access but does not declare them or warn users, which undermines informed consent and security review. In this context, the skill tracks screen activity, stores logs, and references a remote model endpoint, so the undeclared capabilities materially expand privacy and data-exfiltration risk.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documented purpose says the skill is a minimal tracker using cron and bash, but the behavior implied by the skill includes full-screen capture, local image retention, external HTTP analysis, Python-based processing, and cleanup logic. That mismatch is dangerous because users may invoke a seemingly simple tracking skill without realizing it can collect sensitive on-screen data and send it to a remote service.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: A remote VL model endpoint in the configuration indicates screen contents may be transmitted off-device, which is a materially different and more sensitive behavior than local activity tracking or summarization. Because screenshots can contain credentials, messages, proprietary documents, and other secrets, undocumented network analysis raises substantial confidentiality concerns.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The configurable `mlx_url` adds a network-capable analysis path that is not clearly justified by the skill's advertised limited tracking role. This hidden expansion of capability increases the chance of silent data exfiltration or accidental transmission of highly sensitive screen contents to an untrusted host.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The script captures full-screen screenshots and sends them to a configured HTTP inference endpoint, despite the skill being described as 'minimal local screen tracking.' This is a meaningful capability mismatch because screenshots can contain highly sensitive data, and users are not clearly told that image contents leave the host for remote analysis.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The code base64-encodes the screenshot and posts it to a remote model API, which is a powerful exfiltration path for on-screen secrets such as credentials, messages, documents, or tokens. That network transmission is broader than what users would reasonably expect from a 'lite' activity tracker and materially increases privacy and data-loss risk.

Missing User Warnings

High

Confidence: 95% confidence
Finding: The README explicitly states that after the user says '开始追踪屏幕', the skill will automatically take screenshots every 5 minutes and store them under ~/screen-activity, but it does not prominently warn that this may capture passwords, messages, financial data, health information, or other sensitive on-screen content. In a screen-tracking skill, this omission is security-relevant because the documented default behavior is broad, continuous collection of highly sensitive local data with effectively zero privacy guardrails.

Missing User Warnings

High

Confidence: 92% confidence
Finding: The README says screenshots are automatically taken, AI-analyzed, and recorded, and the sample config includes an MLX HTTP endpoint, but it does not clearly disclose that screenshot-derived content may be transmitted over the network to an external or remote AI service. That creates a substantial privacy and data-exfiltration risk because users may assume processing is local while images or extracted activity data could leave the device and reach another host.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The README explicitly says the skill takes screenshots every 5 minutes and has AI read them, but it does not provide a clear privacy warning about capturing potentially sensitive on-screen data such as messages, credentials, financial information, or confidential work content. In a screen-tracking skill, this omission materially increases the risk that users enable continuous surveillance without informed consent or understanding of the sensitivity of the collected data.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The README exposes a configurable remote AI endpoint (`mlx_url`) but does not warn users that screenshots or derived activity data may be sent over the network for analysis. Because screenshots can contain highly sensitive personal or enterprise information, failing to disclose possible transmission to a remote service creates a significant privacy and data-exfiltration risk, especially if users assume all processing is local.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger phrases are broad enough that normal productivity requests like 'daily summary' or 'search history' could activate a skill that performs or manages persistent screen tracking. In a privacy-sensitive skill, ambiguous activation is risky because it can lead to unintended surveillance setup or querying of captured activity without clear user intent.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The skill instructions do not prominently warn users that it performs ongoing screen activity logging and retains captured data locally over time. Given the sensitivity of full-screen captures and behavioral histories, the lack of a clear disclosure and consent flow makes accidental over-collection and privacy harm much more likely.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The configuration mentions an external model endpoint but the skill text does not clearly warn users that captured screen data may be transmitted there for analysis. This is especially dangerous because screenshots can contain highly sensitive information, and users would reasonably assume a 'lite' local tracker is not sending content off-device.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The script sends screenshot contents off-host without any warning, consent prompt, or in-script disclosure, even though screenshots often contain sensitive personal or corporate information. This lack of transparency makes the data collection especially dangerous because users may believe tracking is local while confidential screen contents are actually uploaded.

Tool Parameter Abuse

High

Category: Tool Misuse
Content: # Step 4: Cleanup old screenshots if [ "$KEEP_DAYS" -gt 0 ] 2>/dev/null; then find "$LOG_DIR/screenshots" -maxdepth 1 -type d -mtime +"$KEEP_DAYS" -exec rm -rf {} \; 2>/dev/null fi
Confidence: 84% confidence
Finding: The cleanup command uses `find ... -exec rm -rf {}` on paths derived from a writable log directory and a configurable retention value, creating a destructive deletion primitive if directory contents are manipulated or if symbolic-link and path-handling assumptions fail. While constrained by `-maxdepth 1` and the fixed base path, recursive forced deletion is still unnecessarily risky for routine cleanup logic.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

Code: suspicious.install_untrusted_source
Location: config.example.json:3