Security audit

CSPR Personal Recommender

Security checks across malware telemetry and agentic risk

Overview

This recommender is coherent, but it should be reviewed because it scans browser history and silently updates persistent preference memory.

Install only if you are comfortable with the skill scanning local Chrome/Chromium history, storing derived and raw run artifacts under ~/.cspr, and updating recommendation memory without approval prompts. Review or delete ~/.cspr run/history artifacts if you do not want long-lived browsing traces, and set Telegram delivery intentionally before using the daily newspaper script.

SkillSpector

By NVIDIA

Vulnerability Patterns

Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Missing User Warnings

High

Confidence: 96% confidence
Finding: The skill instructs collection and processing of browser history, local notes, and feedback, then applies an inferred profile silently and explicitly says not to ask for approval. That creates a significant privacy and consent risk because highly sensitive personal data is analyzed and persisted without a user-facing warning, granular consent, or review step.

Session Persistence

Medium

Category: Rogue Agent
Content: Workflow: 0. If the run folder has no history artifact, create it with: interest-scan browser --out RUN/history_evidence.json
Confidence: 88% confidence
Finding: create it with: interest-scan browser --out RUN/history_evidence.json 1. Compact the raw history before reading it: interest-scan compact --in RUN/history_evidence.json --out RUN/history_co

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The activation guidance says to use the skill 'after the user has provided feedback or after several runs,' which is broad enough that an agent may invoke it without a clear, current user request to modify persistent memory. Because this skill reads and updates long-lived preference state, ambiguous triggering can cause unintended profile changes and silent persistence of inferred preferences.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The workflow instructs the agent to write a complete updated profile and apply it with `prefmem update`, but it does not warn that this modifies persistent preference memory. Without a user-facing warning or confirmation, the agent could silently alter long-term preferences based on noisy feedback or inferred signals from prior outputs, creating privacy, autonomy, and integrity risks.

VirusTotal

65/65 vendors flagged this plugin as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.