Security audit

Car Log

Security checks across malware telemetry and agentic risk

Overview

This is a local car mileage, fuel, maintenance, and expense log with no evidence of network access, credential use, or hidden exfiltration.

Install only if you are comfortable keeping vehicle and spending records in a local SQLite database. Confirm the target vehicle and record before adding or deleting data, and avoid storing highly sensitive details in notes.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The top-level trigger list includes very generic terms like “里程”, “加油”, and “保养”, which can match ordinary conversation rather than a clear request to use the skill. That increases the risk of unintended activation and accidental writes or queries against the user's car-log data.

Vague Triggers

Low

Confidence: 84% confidence
Finding: The workflow trigger phrases for mileage logging are underspecified and do not clearly distinguish between discussion, estimation, and an actual request to persist a record. This can cause accidental logging when a user is merely talking about mileage or describing a past event.

Vague Triggers

Low

Confidence: 86% confidence
Finding: Refuel logging triggers such as talking generally about fuel or money spent can fire on non-operational discussion. Because this path performs a write and then a follow-up calculation, an unintended activation can corrupt records and derived consumption statistics.

Vague Triggers

Low

Confidence: 85% confidence
Finding: Maintenance-related trigger phrases are broad enough to match casual conversation about repairs or oil changes without intent to store a record. This can create false entries in maintenance history, which may mislead future recommendations and expense summaries.

Vague Triggers

Low

Confidence: 81% confidence
Finding: Expense-query triggers are broad and may activate during ordinary discussion of costs, causing the skill to query and reveal spending information when the user did not intend to access records. While less severe than unintended writes, it still risks privacy leakage and confusing behavior.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.