Security audit

context-not-control

Security checks across malware telemetry and agentic risk

Overview

The skill appears aimed at making agents more autonomous, but its examples and helper script leave too much room for broad file changes, persistent jobs, external notifications, and database updates without clear user approval.

Review before installing. Use this only if you intentionally want a higher-autonomy workflow, restrict any helper scripts to your workspace context file, and require explicit approval for persistent jobs, webhooks, database/schema changes, production-impacting actions, and any writes outside the intended project context.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The script accepts a user-supplied --project-file path and then appends attacker-controlled content to that path without restricting it to a detected PROJECT.md in the workspace. In an agentic setting, this expands the write primitive from 'update project context' to arbitrary file modification, which can overwrite or poison other markdown, config, or prompt files reachable by the process.

Vague Triggers

Medium

Confidence: 85% confidence
Finding: The description is broad enough to match many ordinary requests about autonomy, clarification, or collaboration style. Over-broad activation can cause the skill to engage unexpectedly and shift the interaction toward higher-autonomy behavior without the user intentionally opting into that operating model.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The 'When to Use This Skill' triggers are ambiguous and apply to many common situations, such as vague requirements or wanting less back-and-forth. In context, this is more dangerous because the skill's purpose is to increase AI autonomy, so accidental invocation could lead to actions being taken under an unexpectedly permissive workflow.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: This example normalizes making persistent system changes (installing a cron job) and configuring outbound data transmission (Slack webhook) after only a generic 'Proceed?' prompt, without clearly warning about persistence, credential handling, or ongoing exfiltration of failure data to a third-party service. In a skill designed to encourage autonomous execution, this is dangerous because users and downstream agents may infer that such side effects are acceptable without explicit, informed consent.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The Level 1 example depicts autonomous implementation including database updates with no user-facing confirmation, which can legitimize high-impact state changes without informed approval. In the context of a 'Context, not Control' skill that explicitly promotes greater agent autonomy, this lowers safeguards around schema changes and could lead to data loss, service disruption, or unauthorized modifications if copied into real workflows.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.