Security audit

archviz-skills

Security checks across malware telemetry and agentic risk

Overview

This visualization skill is not clearly malicious, but it needs review because it can generate HTML that loads third-party scripts and it includes instructions for modifying its own skill files.

Install only if you are comfortable reviewing generated HTML before opening it, especially files that load Chart.js, Three.js, or animejs from CDNs. Consider disabling or removing the self-evolution section, requiring explicit approval before any edits to installed skill files, and vendoring or pinning browser dependencies for offline or sensitive environments.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The skill presents itself as safe while instructing use of executable external CDN imports and network validation commands. In an agent context, this increases supply-chain and remote-content risk because generated HTML or validation steps may load attacker-controlled or changed third-party code at render time.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The self-evolution section instructs the agent to evaluate and modify its own skill files, including applying changes via search/replace. Self-modification expands the skill beyond visualization into codebase mutation, which can be abused to persist unsafe changes or bypass review boundaries.

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: Labeling output as self-contained HTML while relying on CDN-hosted imports can mislead users and downstream agents about the trust and offline-execution model. This can cause unsafe assumptions, including opening generated files that silently fetch and execute remote JavaScript.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The file imports executable JavaScript modules from third-party CDNs at runtime, which introduces a software supply chain and integrity risk. If the CDN, package, or delivery path is compromised, anyone opening the HTML could execute attacker-controlled code in their browser; this is more concerning here because the skill is presented as portable/self-contained visualization output, which may cause users to trust and open it offline-like without expecting remote dependencies.

Context-Inappropriate Capability

Low

Confidence: 88% confidence
Finding: The page imports executable JavaScript modules from third-party CDNs at runtime, creating a supply-chain and integrity risk. If the CDN, account, or dependency path is compromised, opening this local HTML file would execute attacker-controlled code in the browser.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The template is presented as self-contained HTML but loads Chart.js from an external CDN, creating a supply-chain and integrity risk. If the CDN response is tampered with, unavailable, or blocked, the generated visualization can execute untrusted script or fail at runtime, which is especially relevant for agent-delivered artifacts expected to be portable and preview-safe.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The template is presented as self-contained, but it fetches Chart.js from a third-party CDN at runtime. That creates a supply-chain and privacy risk: rendering depends on remote code that can change, fail, be blocked, or expose user IP/request metadata, which directly contradicts the documented deployment model.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The documentation explicitly claims the output is self-contained, yet the delivered HTML requires a remote script to function. This mismatch is dangerous because users may paste or open the file in environments expecting offline/local-only behavior, unintentionally introducing external network access and third-party code execution.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The template loads executable ES modules directly from third-party CDNs at runtime, so anyone controlling the CDN, package account, dependency publication, or the network path can change the code executed in the user's browser. In an agent skill advertised as a self-contained HTML visualization template, this materially increases supply-chain risk and can lead to arbitrary script execution, data exfiltration, or malicious rendering behavior.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The template claims to be self-contained, but it loads Three.js and animejs from public CDNs at runtime. This creates a supply-chain and integrity risk: if the CDN content is tampered with, unavailable, or version-shifted, any agent or user opening the template executes untrusted remote code in the browser.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The inline comment materially misrepresents the trust boundary by stating there is 'no external models' and 'Self-contained' while the import map pulls executable modules from jsDelivr. In an agent skill context, misleading dependency claims increase the chance that downstream systems treat the file as safe for offline or restricted environments when it actually requires and executes third-party code.

Vague Triggers

High

Confidence: 92% confidence
Finding: Enabling implicit invocation without narrowing conditions increases the chance that the skill is auto-selected for loosely related requests, causing unrequested prompt injection into conversations and potentially steering outputs in ways the user did not ask for. While this skill is not obviously high-risk, its wide trigger surface can create control and reliability issues, especially because the package supports multiple output modes including code-generating formats like HTML, Python, and Three.js.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The template loads a CDN-hosted script without any user-facing warning that opening the file will contact a third party and execute remote JavaScript. In this skill context, users may trust the template for Obsidian or direct local browsing, so the lack of disclosure increases the chance of silent privacy leakage and unexpected script execution.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.