Skill Creator 0.1.0

• Outcome: Pass
• Latest audit: May 29, 2026 · 8:13 PM UTC
• Version: 1.0.0

Overview

This is a coherent skill-building helper that creates and packages skill files when asked, with no evidence of hidden network, credential, persistence, or destructive behavior.

Install this if you want an agent to help build skill packages. Use it only on intended skill workspaces, review generated SKILL.md and bundled resources before packaging, and make sure the folder being packaged does not contain secrets or unrelated private files.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill instructs the agent to read and write files, execute local scripts, and package artifacts, but no permissions are declared. That mismatch creates hidden capability expansion: a caller may invoke what appears to be a documentation skill, while the agent is actually guided to perform filesystem and shell actions with possible network-adjacent effects during script execution or dependency use.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The description is broad enough to trigger whenever a user wants to create or update a skill, which can cause this powerful meta-skill to activate in many contexts. Because the body then recommends creating files, deleting example resources, and running scripts, over-broad activation increases the chance of unintended code execution or repository modification in conversations that only needed advice.

Self-Modification

High

• Category: Rogue Agent

Content

1. Understand the skill with concrete examples
2. Plan reusable skill contents (scripts, references, assets)
3. Initialize the skill (run init_skill.py)
4. Edit the skill (implement resources and write SKILL.md)
5. Package the skill (run package_skill.py)
6. Iterate based on real usage

• Confidence: 90% confidence
• Finding: This section explicitly instructs the agent to initialize a skill, edit files, and package the result, which is a form of self-modification or agent-capability modification. In context, this is the skill's purpose, but it is still dangerous because it turns a conversational request into persistent changes on disk and executable workflow steps, potentially allowing an attacker to smuggle unsafe instructions into newly created skills.

Self-Modification

High

• Category: Rogue Agent

Content

Any example files and directories not needed for the skill should be deleted. The initialization script creates example files in `scripts/`, `references/`, and `assets/` to demonstrate structure, but most skills won't need all of them.

#### Update SKILL.md

**Writing Guidelines:** Always use imperative/infinitive form.

• Confidence: 88% confidence
• Finding: The instruction to update SKILL.md and delete unneeded generated files again authorizes persistent repository changes. Even though this is framed as normal skill-authoring behavior, it can be exploited to overwrite instructions, remove safeguards, or plant malicious resources in a skill package that another agent will later trust and execute.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.