Security audit

doc-consolidation

Security checks across malware telemetry and agentic risk

Overview

This skill is a documentation cleanup helper that reads report files, merges useful content into docs, and deletes approved source artifacts after consolidation.

Install only if you want an agent to help clean up temporary markdown reports by merging them into permanent docs. Review the proposed files and deletion list carefully before approving execution, especially because deleted source files are not automatically restorable.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The trigger list includes broad generic terms such as "docs" and "cleanup", which are common in normal conversations and could cause the skill to activate unexpectedly outside its intended consolidation context. While the skill’s described actions are documentation-focused, unintended invocation could still lead to confusing workflow hijacking, unnecessary file analysis, or accidental document modification if the agent auto-runs skills based on trigger matching.

Missing User Warnings

Low

Confidence: 92% confidence
Finding: This module explicitly instructs creating new files and updating existing documentation, but it does not require any user-visible warning, confirmation, or dry-run step before filesystem changes occur. In a documentation-consolidation skill, silent writes are risky because an agent could modify repository files unexpectedly, making unintended or overly broad changes harder for a user to detect before they happen.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The module performs irreversible source deletion automatically after merge success, with no explicit user confirmation, dry-run gate, backup requirement, or prominent warning at the point of execution. In a documentation-consolidation skill, source files may contain unique context or the merge may be imperfect, so silent deletion can cause data loss that is hard to detect until after the originals are removed.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The rollback logic explicitly admits deleted sources cannot be restored automatically, yet the workflow still deletes them after consolidation without a prominent warning or recovery mechanism. This increases the danger of permanent documentation loss, especially because LLM-generated merges can be inaccurate, incomplete, or semantically lossy even when execution technically succeeds.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.