Security audit

git-workspace-review

Security checks across malware telemetry and agentic risk

Overview

The skill is a git review helper, but it claims to be read-only while instructing agents to change staging state and potentially edit files.

Install only if you are comfortable with a git helper that may alter staged files and run project formatting/lint commands. Treat it as write-capable, review its actions before allowing changes, and avoid using broad triggers like status or diff when you only want a display-only command.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill advertises itself as a read-only preflight, but the documented workflow explicitly tells the user to stage or unstage files and run formatting/lint commands that may modify the working tree. This mismatch can cause an agent or user to trust the skill as non-mutating when it can in fact alter repository state, increasing the chance of unintended changes or unsafe automation.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The documentation repeatedly frames the skill as a read-only review, yet later steps instruct actions that can change the git index and file contents. In an agent setting, this kind of safety-contract violation is dangerous because downstream systems may permit execution based on the declared low-risk profile while the actual instructions perform mutations.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The triggers include generic terms like 'status' and 'diff' that are common in normal development conversation. Overly broad triggers can cause the skill to activate unexpectedly in unrelated contexts, which is more concerning here because the skill contains instructions that may change repository state despite being presented as read-only.

Shadow Command Trigger

Medium

Category: Trigger Abuse
Confidence: 90% confidence
Finding: The trigger 'status' conflicts with a built-in command name, creating ambiguity about whether the platform should execute the built-in behavior or activate this skill. That ambiguity can lead to accidental invocation of a skill whose documented steps are not actually read-only, amplifying the operational risk.

Shadow Command Trigger

Medium

Category: Trigger Abuse
Confidence: 90% confidence
Finding: The trigger 'diff' shadows a built-in command and may cause the skill to intercept a routine request for diff output. Because the skill includes mutating guidance, accidental activation in place of a standard read/display command could mislead an agent into taking broader actions than intended.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.