Security audit

summon

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed autonomous development orchestrator, but it can keep running, re-enter itself, and modify or merge repository work with limited user control.

Install only if you intentionally want an autonomous repository workflow runner. Use bounded mode, keep auto_merge disabled unless protected-branch review is already enforced, review .egregore state before launch, avoid feeding it untrusted GitHub issues without supervision, and delete any scheduled cron recovery when you want the run to stop.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill instructs the agent to create a recurring cron task that can re-invoke the orchestrator automatically whenever work appears stalled. This creates persistence and self-relaunch behavior beyond normal task execution, increasing the risk of runaway automation, repeated unintended actions, and reduced operator control, especially because it can continue re-entering the pipeline without fresh user approval.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The trigger list contains broad terms such as 'autonomous', 'pipeline', 'orchestrator', and 'mission', which are likely to match ordinary user requests and cause accidental invocation of a powerful autonomous skill. In this context, accidental activation is more dangerous because the skill is designed to read manifests, invoke other skills, modify state files, and continue processing work items with minimal human interaction.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill presents itself as an orchestrator for development lifecycle work but does not prominently warn that it may autonomously modify project state, invoke multiple subordinate skills, schedule recovery behavior, and run for an extended period. In this skill's context, the missing warning materially increases the chance that users invoke it without understanding the breadth of actions it may take, leading to unintended code, file, or workflow changes.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The module explicitly instructs the orchestrator to 'never block' and to proceed without human input when requirements are ambiguous. In an autonomous orchestration skill, that encourages irreversible or user-impacting actions based on assumptions, which can lead to unauthorized changes, incorrect scope expansion, or unsafe pipeline behavior even if decisions are logged.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The examples normalize skipping brainstorm, narrowing scope unilaterally, and especially ignoring non-blocking warnings or lint issues on retry without any user-facing caution or risk criteria. In an autonomous pipeline, this can condition agents to bypass review and quality signals that may be the only indicators of unsafe, noncompliant, or unintended changes.

Missing User Warnings

Medium

Confidence: 72% confidence
Finding: The module instructs automatic retrieval and processing of full GitHub issue bodies and comments, which may contain sensitive data, internal context, or malicious prompt content. In an autonomous orchestrator, ingesting this unfiltered external content increases the chance of privacy leakage and prompt-injection-driven downstream behavior, especially because comments are treated as actionable requirements or clarifications.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The module directs automatic branch creation or checkout during intake, which mutates the local repository before a user confirms the parsed work item is valid. In an autonomous pipeline, unreviewed prompts or issue-derived slugs can cause unexpected repository state changes, clutter, or interference with ongoing work, making this more dangerous than a normal interactive tool.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The module specifies automatic execution of a local Python script with title and description values derived from parsed work-item content. Because the skill is an autonomous orchestrator and the inputs may originate from prompts or GitHub issues, this creates a risky trust boundary where attacker-controlled text is passed into a subprocess, raising concerns about command/argument injection, unsafe downstream handling, and unintended data exfiltration to local tooling.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The module explicitly defines an automatic `merge` step and notes it is enabled by `auto_merge: true`, but it does not require any user-facing confirmation or warning about repository-modifying effects. In an autonomous orchestrator skill, this increases the risk that code is merged without adequate human review, potentially landing unsafe, incorrect, or attacker-influenced changes.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: The documentation describes merging completed worktree results back into the target branch, including generated git merge commands, without warning about branch modification and conflict consequences. In a system designed for concurrent autonomous execution, this can normalize repository-changing operations without emphasizing safeguards, increasing the chance of accidental or unsafe merges.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.