Security audit

mcp-code-execution

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly coherent for MCP workflow optimization, but it gives broad routing, subagent, and external-storage guidance without enough scoping or data-handling controls.

Install only if you want an agent to proactively route large workflows through MCP code-execution and subagent patterns. Before using it with sensitive datasets, define where external results and logs may be stored, require redaction for secrets or PII, and prefer explicit invocation for MCP workflows instead of relying on broad automatic keywords.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The module repeatedly states that all patterns use the standard `tools/extracted_tool.py` interface, but its core example instructs use of a different `mcp_code_execution()` mechanism. This inconsistency can cause an agent or operator to invoke the wrong execution path, weakening expected controls, validation, logging, or review boundaries associated with the standard tool interface.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The skill defines automatic activation on generic terms like "code execution," "MCP," "tool chain," and "data pipeline," which are common in normal developer discussion and can cause the orchestration hub to activate without explicit user intent. In this skill's context, unintended activation is more dangerous because it is a routing hub that can delegate to multiple submodules and influence workflow/tool selection across a session, increasing the chance of unnecessary tool use, context consumption, and unexpected execution planning.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The examples explicitly direct intermediate and external result storage without any warning, data classification guidance, retention limits, or redaction requirements. In a coordination skill for large datasets and multi-tool workflows, this can lead users or downstream implementations to persist sensitive pipeline data and coordination context in logs or external stores, increasing exposure through unauthorized access, over-retention, or accidental disclosure.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The automatic activation keywords (`pattern`, `transform`, `optimize`, `code execution`) are broad enough to trigger this skill in many unrelated contexts. In a skill that routes workflows into code-execution patterns, ambiguous triggering increases the chance of unintended code-execution recommendations or transformation of tasks that should remain transparent and manually reviewed.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The activation keywords include generic terms like "subagent," "decompose," "break down," and "modular," which can appear in ordinary user requests and unintentionally trigger this skill. In a code-execution and MCP orchestration context, accidental activation can cause unnecessary delegation, tool routing, or broader access to external MCP-connected capabilities than the user intended.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The module auto-invokes on very generic keywords like "validate", "check", "monitor", and "compliance", which are common in ordinary user requests and unrelated workflows. In an agent skill system, this can cause unintended activation, unnecessary interception of tasks, and expanded access to workflow data, increasing the chance of misrouting or policy bypass through skill overlap.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.