Security audit

Project Brief Writer

Security checks across malware telemetry and agentic risk

Overview

This skill is mainly a local project-brief drafting helper; it can run a bundled Python script on user-chosen inputs, but the active configuration is local, limited, and purpose-aligned.

Install only if you are comfortable with a local Python helper that can read the input file you choose and write the output file you choose. Use it on intended project materials, avoid broad sensitive directories, and review generated briefs before relying on them for decisions.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 86% confidence
Finding: The skill declares no explicit permissions, yet its instructions and metadata indicate capabilities consistent with file access and shell execution. This creates a transparency and trust problem: a user may invoke what appears to be a simple document-formatting skill while it can access local resources and run code, increasing the chance of unintended data exposure or command execution.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documented purpose is limited to organizing requirements into a project brief, but the finding indicates the underlying behavior includes directory scanning, file content analysis, regex-based secret/private-URL detection, and skill-audit modes. Hidden or materially broader behavior is dangerous because it can cause the skill to inspect unrelated local data and operate outside user expectations, which is especially risky for an end-user-invocable skill.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: Authorizing shell or Python script execution is unnecessary for a skill whose stated function is text organization and drafting. Even if the script is local, allowing execution expands the attack surface to command execution, path manipulation, malicious script substitution, or misuse of input/output file arguments, turning a low-risk drafting workflow into one that can affect the host environment.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The skill claims a 'default read-only' safety boundary, but separately permits running a local Python script that can read and write files. This inconsistency is dangerous because it can mislead users and reviewers about the real risk profile, causing them to approve or invoke the skill under false assumptions about its ability to modify data or perform side effects.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The script implements directory auditing, repo inspection, pattern scanning, and skill-package auditing modes that materially exceed the stated purpose of writing project briefs from scattered requirements and meeting notes. This creates unnecessary capability to enumerate local files and surface sensitive content patterns, increasing the chance of unintended data access or misuse in environments where the skill is expected to process only user-provided briefing material.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: The hard-coded PATTERNS include secret-like tokens, private URLs, and dangerous shell command signatures, enabling the skill to perform security-oriented content scanning unrelated to its declared project-brief function. In context, this is more dangerous because users would not reasonably expect a brief-writing skill to inspect repositories or documents for security artifacts, which can expose confidential snippets in generated output.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.