Security audit

File Drop Organizer

Security checks across malware telemetry and agentic risk

Overview

This is a local, review-first folder organizer that scans a user-chosen directory and can write a report, with no evidence of deletion, network access, persistence, or credential theft.

Install only if you are comfortable with a local helper reading filenames and limited text content from the folder you choose. Use it on Downloads or temporary folders first, keep the default dry-run behavior, review any generated move plan before acting, and avoid broad or sensitive directories unless that exposure is intentional.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill advertises read-only, dry-run organization behavior but explicitly allows invoking python3 and references reading templates/specs and writing output files, which implies file read, file write, and shell capabilities without any declared permission model. This creates a trust and containment gap: an operator or orchestrator may treat the skill as low-risk while it can access local files and execute a subprocess.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 88% confidence
Finding: The declared purpose is limited to organizing download or temporary directories with a review-first workflow, but the detected behavior indicates broader auditing, content scanning, regex-based secret/dangerous-pattern inspection, spec-driven mode switching, and report generation. This mismatch is dangerous because it can expand the skill from simple file organization into generalized filesystem inspection and content analysis, increasing the chance of unexpected access to sensitive data and misuse under a benign-seeming description.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The dispatcher enables multiple generic audit modes such as directory, CSV, pattern, and skill auditing that do not align with the declared purpose of organizing download or temporary-file directories. This capability mismatch increases the skill's access to arbitrary local content and creates a broader-than-advertised inspection surface, which is risky in an agent setting because users may grant trust based on the manifest description.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The pattern scanning logic reads arbitrary files and searches for secrets, internal URLs, and command-execution indicators, which is outside the stated file-organization use case. In a skill ecosystem, that effectively turns the tool into a lightweight content inspector that can surface sensitive snippets from unrelated files, expanding privacy and data-exposure risk beyond user expectations.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The skill audit mode can inspect arbitrary skill package structure and parse frontmatter metadata, which is not justified by the manifest's organizer description. This broadens the script into a generic package-inspection tool and may expose internal project structure or metadata from directories the user did not expect to be analyzed under an organizer skill.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.