Security audit

nas-master

Security checks across malware telemetry and agentic risk

Overview

This NAS indexing skill is not clearly malicious, but it needs review because it asks for powerful NAS and SSH access while persistently indexing broad private file metadata.

Review before installing. Use a dedicated read-only NAS and SSH account, pin or verify the SSH host key before connecting, restrict scans to approved volumes, avoid hidden sensitive folders unless needed, and secure or disable the MySQL/PHP dashboard because it may expose indexed private file paths and system metadata.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill declares environment variables for NAS, SSH, and database credentials and describes filesystem crawling, but it does not declare explicit permissions aligned to those capabilities. This weakens user awareness and policy enforcement because a user may invoke a skill that can access sensitive local files and secrets without a clear permission boundary.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The manifest and description portray the skill as a strictly read-only NAS metadata scraper, but the documented behavior includes database writes, on-disk PHP dashboard generation, and trust-modifying SSH behavior. This mismatch is dangerous because operators may authorize the skill under false assumptions, enabling write actions and weakened SSH trust controls they did not expect.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: Claiming 'strict read-only' while also directing database persistence and generating a PHP dashboard on disk is a direct contradiction of the safety model presented to the user. In a skill handling NAS contents and credentials, hidden write behavior increases the chance of unauthorized state changes, data leakage, or deployment of unintended web-accessible artifacts.

Description-Behavior Mismatch

Medium

Confidence: 83% confidence
Finding: The manifest frames the skill as a NAS metadata scraper, but the body broadens it into coding, project management, business analysis, and strategic planning. This scope expansion is risky because it can cause the agent to take actions or process data beyond the narrowly expected NAS-scraping context, increasing the chance of overreach and unintended access.

Context-Inappropriate Capability

Medium

Confidence: 86% confidence
Finding: Requiring the skill to search for free online tools, APIs, and resources expands it from local/NAS metadata work into external discovery and potential network access. In the context of a skill with access to sensitive NAS and credential data, that broader behavior raises the risk of inadvertent data exposure, prompt injection from remote content, or unauthorized outbound interactions.

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The instructions explicitly describe the skill as 'Strict Read-Only' while simultaneously directing database persistence and file generation. This kind of self-contradictory safety claim is dangerous because it normalizes hidden side effects and undermines a user's ability to accurately assess operational risk before invocation.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The skill establishes an SSH session using environment-sourced credentials and trusts unknown host keys via AutoAddPolicy, expanding its reach beyond simple local metadata scraping. In a skill advertised as read-only metadata collection, this remote command capability increases the blast radius if the environment is misconfigured, the target host is spoofed, or the skill is repurposed to run arbitrary commands.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The skill metadata explicitly claims 'strict read-only safety', but this SQL script performs write-capable administrative actions by creating a database and table. That mismatch is dangerous because users or automation may trust the read-only claim and run the skill in environments where any state-changing operation violates policy, causing unauthorized modification of infrastructure.

Vague Triggers

Medium

Confidence: 79% confidence
Finding: Broad role labels such as coder, business analyst, and project manager are ambiguous and can trigger behavior far beyond the intended NAS-scanning function. In an agentic setting, vague scope can lead to unintended invocation paths, privilege creep, and misuse of available credentials or system access.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: Open-ended directives to be proactive, adaptive, and to continuously search for tools and resources lack clear stopping conditions and authorization boundaries. When combined with access to credentials, files, and SSH targets, this can encourage excessive action-taking and expansion into external systems without clear user intent.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill requires sensitive credentials for NAS, SSH, and database access but does not provide an explicit user-facing warning about handling secrets or the sensitivity of scanned data. This is dangerous because users may not realize the skill can access privileged infrastructure and aggregate sensitive metadata, leading to accidental overexposure or unsafe use.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The code opens an SSH connection with credentials from the environment without any user-facing disclosure, and it does so in a way that implicitly trusts new host keys. This combination can cause operators to unknowingly grant remote access and makes man-in-the-middle or wrong-host connections more plausible in operational environments.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.