Security audit

agent-teams

Security checks across malware telemetry and agentic risk

Overview

This skill is not clearly malicious, but it should be reviewed because it can start, stop, and replace Claude agent processes and delete coordination state without strong confirmation safeguards.

Install this only if you intentionally want tmux-based multi-agent Claude orchestration. Expect persistent state under ~/.claude/teams and ~/.claude/tasks and additional Claude processes. Before using deletion, lock cleanup, or automatic recovery, require a manual confirmation or backup workflow and keep activation limited to explicit agent-team requests.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The trigger list includes very broad terms such as "coordination," "messaging," and "task-management," which can cause the skill to activate for ordinary user requests unrelated to multi-agent orchestration. Because this skill can lead to spawning multiple Claude CLI processes and coordinating through persistent files under ~/.claude, overbroad activation increases the chance of unexpected side effects and unintended delegation behavior.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill introduces a system that spawns separate Claude CLI processes and persists coordination data under ~/.claude, but the top-level description and early usage guidance do not prominently warn users about these side effects. This can mislead users into invoking the skill without understanding that it may create background team state, write task/message files, and consume additional resources.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The troubleshooting section tells operators to manually remove .lock files if an agent crashes, but it does not warn that deleting lock files while another process is still active can corrupt task or inbox state and break coordination guarantees. In a concurrent filesystem protocol, unsafe lock removal can cause race conditions, duplicate task claims, lost messages, or inconsistent team state.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill prescribes destructive recovery actions such as killing a tmux pane, respawning an agent, releasing claimed tasks, and decommissioning/replacing agents without any explicit user confirmation, approval gate, or safety constraints. In an agent-orchestration context, these actions can terminate active work, discard state, or trigger unintended cascading automation if stall detection is wrong or manipulated.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The documented delete behavior permanently unlinks task files and rewrites dependency references without any confirmation, soft-delete period, or recovery mechanism. In a multi-agent filesystem-coordination system, an accidental or malicious status update to "deleted" could erase work state and coordination metadata, causing task loss, dependency corruption, and denial of service for the team workflow.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill documents deletion of both team and task directories without any warning, confirmation, or explicit safety guard. In a filesystem-driven multi-agent system, an accidental or overly broad delete operation can cause irreversible loss of coordination state, active task data, and agent mailboxes, especially if triggered by automation or mis-parsed inputs.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.