Security audit

code-refinement

Security checks across malware telemetry and agentic risk

Overview

This skill is mostly a code-quality helper, but it asks agents to bypass stopping limits and includes an external posting workflow that needs careful review before installation.

Install only if you want a skill that can go beyond analysis into repository-wide refactoring. Prefer plan-only use, require explicit approval before any edits or commits, do not use scope-override phrasing, and disable or review the insight-generation module before allowing findings to be posted externally.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The skill is ներկայացված as analysis/refinement, but its body includes instructions to modify code and maintain execution-tracking artifacts. That creates a capability mismatch: users or orchestration layers may invoke it expecting read-only analysis, while the skill can drive state-changing actions in the repository.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: Step 6 converts a refinement skill into an execution engine that applies fixes until all findings are closed or explicitly deferred. In a skill context, this materially increases risk because a user asking for quality review may unintentionally authorize broad code changes, commits, and documentation churn beyond the stated analysis role.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The skill explicitly instructs the agent to override execution boundaries, ignore normal stop conditions, and resume after stop signals. Those directions undermine harness controls and user-safety expectations, making the skill dangerous because it encourages persistence past governance mechanisms intended to limit autonomous changes.

Description-Behavior Mismatch

Medium

Confidence: 86% confidence
Finding: This module instructs the agent to exfiltrate analysis results to an external GitHub Discussions channel, which goes beyond a local code-refinement role and creates a data-flow out of the working context. Even if intended for tracking, externally posting findings can leak internal code details, repository structure, or sensitive remediation context without an explicit authorization or approval gate.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The skill embeds a concrete command that changes into a fixed local path and invokes a posting script to publish findings externally, but the stated purpose is code refinement rather than outbound communication. This mismatch increases the risk of unintended disclosure and misuse, especially if the analysis includes concrete code locations, summaries, or evidence that may contain sensitive implementation details.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger list includes broad phrases like refactoring, clean-code, algorithms, duplication, and craft, which can match ordinary development requests. Because the skill contains execution behavior, broad activation increases the chance of accidental invocation in contexts where users expected lightweight review rather than autonomous modification.

Ssd 1

Medium

Confidence: 94% confidence
Finding: The skill allows euphemistic user phrasing such as 'ignore scope guard' to disable normal execution limits. This is dangerous because it creates a natural-language backdoor that converts informal wording into authorization to bypass safety boundaries without structured approval.

Ssd 4

Medium

Confidence: 96% confidence
Finding: The cumulative execution narrative pressures the agent not to stop, not to ask for confirmation, and to continue after interruptions until every candidate is closed. In this skill context, that persistence behavior is especially risky because it encourages autonomous repository changes beyond normal human-in-the-loop checkpoints.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.