Security audit

AAR Loop

Security checks across malware telemetry and agentic risk

Overview

The skill is purpose-aligned and not deceptive, but its broad auto-triggering and durable lesson-writing can persist task context and shape future agent behavior without narrow controls.

Install only if you intentionally want persistent workspace memory for after-action lessons. Narrow or disable automatic triggers, avoid using it during secrets or sensitive-data work, and require explicit approval before writing lesson files or applying any fix that changes future-loaded rules or skills.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill instructs use of file reads, file writes, and script execution behavior, but it does not declare any permissions or boundaries for those capabilities. That creates a transparency and policy gap: a host system or reviewer cannot easily determine what access the skill expects, making unintended file modification or data exposure more likely when the skill auto-runs.

Vague Triggers

High

Confidence: 95% confidence
Finding: The trigger list includes generic phrases like "fix it" and "what did we learn," which are common in normal conversation and can cause the skill to activate outside explicit user intent. Because this skill can write persistent lessons and propose changes to future-loaded skills and rules, accidental invocation could lead to unintended durable state changes or workflow manipulation.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The description says the skill can write to a persistent LESSONS.md and propose or write fixes to skills and rules files loaded in later sessions, but it does not prominently warn about these durable side effects. This creates a risk that users or calling agents invoke it without understanding that it can alter future behavior and persist data across sessions.

Vague Triggers

High

Confidence: 96% confidence
Finding: The description says the skill auto-triggers for all tasks, which is an overly broad invocation scope for a skill that can read and write workspace files. A universal trigger can cause the skill to run during unrelated, sensitive, or high-volume tasks, leading to unnecessary persistence of task details, accidental leakage into lesson files, and uncontrolled file churn.

Vague Triggers

High

Confidence: 98% confidence
Finding: The Auto-Trigger section mandates invocation after every task without meaningful exclusions, including small tasks, and ties it into workflow execution. In context, this is more dangerous because the skill also prescribes writing durable lessons to disk, so broad mandatory triggering increases the chance of storing sensitive context, over-collecting data, and normalizing autonomous file writes.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.