aifs
2 findings (1 high, 1 medium), mainly data exfiltration. Most recent scan 2026-02-05.
This skill presents MODERATE security risks primarily related to data exfiltration and credential exposure. The core functionality - uploading arbitrary content to an external cloud service (aifs.space) - creates inherent risks of sensitive data leakage. The skill instructs agents to access API keys from environment variables and transmit user data to external servers without content validation or explicit per-operation consent. While the description includes a disclaimer against sensitive content, there are no technical controls to enforce this policy. The missing 'allowed-tools' declaration reduces transparency about required capabilities. The skill would benefit from content scanning, explicit user confirmation prompts, secure credential handling, and clearer security warnings.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
Store and retrieve files via AIFS.space cloud storage API. Use when persisting notes, documents, or data to the cloud; syncing files across sessions; or when the user mentions AIFS, aifs.space, or cloud file storage. Not to be used for any sensitive content.
- Package
- 1 file, 3.9 KB
- SKILL.md
- 434 words, 12+ sections
- Code
- None. Instructions only.
SKILL.md covers: AIFS - AI File System · Human · Authentication · Base URL · Endpoints · List Files · Read File · Full file · Line range (1-indexed) · Write File · Patch File (Line Replace) · Delete File
Findings
HIGH API Key Exposure Risk via Environment Variable Data Exfiltrationllm
The skill instructs the agent to check for the AIFS API key in environment variables (AIFS_API_KEY). If the agent has access to environment variables, this could expose sensitive credentials. The skill also encourages users to provide API keys directly to the agent, creating a credential handling risk where keys may be logged, cached, or inadvertently exposed.
Check for key in environment (`AIFS_API_KEY`) or user config.
Authentication section instructs: 'Requires API key in headers. Check for key in environment (`AIFS_API_KEY`) or user config.'MEDIUM Unrestricted Cloud Data Transmission Data Exfiltrationllm
The skill enables uploading arbitrary file content to an external cloud service (aifs.space) without content validation, size limits, or explicit user consent per operation. While the description states 'Not to be used for any sensitive content', there are no technical controls to prevent sensitive data exfiltration. An agent could be manipulated to upload credentials, private keys, or confidential documents.
Write File endpoint: 'curl -X POST -H "Authorization: Bearer $AIFS_API_KEY" -H "Content-Type: application/json" -d '{"path":"notes/new.txt","content":"Hello world"}' https://aifs.space/api/write'
No validation or filtering of content before transmission to external service.What is in the package
| File | Kind | Size |
|---|---|---|
SKILL.md | doc | 3.9 KB |
External hosts referenced
aifs.space
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Environment variables referenced
AIFS_API_KEY KEY
Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://clawhub.ai/skills/aifs-space
- Raw scan result: aifs-http-file-system-scan.json
- Badge for your README:
- Request a re-scan