tutorial-updates

• Outcome: Review
• Latest audit: Aug 26, 2026 · 1:35 PM UTC
• Version: 1.9.19

Overview

This tutorial-generation skill is transparent about its purpose, but it can run project-supplied shell commands, rebuild binaries, and edit documentation without strong scoping or approval safeguards.

Install and use this only for trusted repositories. Before running it, review all .tape files and manifest requires entries, avoid --skip-validation, approve any cargo install, make build, npm, go, VHS, or Playwright commands, and prefer a disposable container or clean workspace for recording demos.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The skill explicitly instructs extracting commands from tutorial tape files and executing each locally via `timeout 5s bash -c "$cmd"`. Because tape files are content inputs rather than trusted code, this creates an arbitrary command execution path during validation, allowing a crafted tape to run destructive shell commands, exfiltrate data, or modify the host environment. In the context of a tutorial-update skill, executing embedded commands may feel functionally related, but doing so without strict allowlisting or sandboxing makes the behavior substantially more dangerous.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The skill includes logic to detect build systems and rebuild binaries using `cargo install` or `make build`, which modifies the local environment and may execute project-defined build scripts. In untrusted or partially reviewed repositories, build steps can run arbitrary code, fetch dependencies, overwrite installed binaries, or persist changes outside the project workspace. While rebuilding can be relevant to demo freshness, the skill does not constrain this behavior or require strong consent, so it meaningfully increases attack surface.

Vague Triggers

Medium

• Confidence: 78% confidence
• Finding: The trigger list contains broad generic terms such as `tutorial`, `gif`, `documentation`, and `demo`, which can cause the skill to activate in many benign contexts beyond its intended narrow use. Because this skill can lead to validation, local command execution, and rebuild workflows, over-broad invocation increases the chance of accidental exposure to risky actions on unrelated repositories or user requests.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill directs local execution of extracted commands during validation but does not present a clear, upfront warning that this can execute untrusted shell commands and change system state. Users invoking a documentation/tutorial skill may reasonably expect content generation, not command execution against their host. This mismatch can lead to unsafe consent and unintended system compromise.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The manifest format explicitly allows arbitrary shell commands in `requires` to be executed as background processes before running Playwright specs, but the documentation provides no warning, trust boundary, or restriction on command content. In a tutorial-orchestration skill that may process repository-supplied manifests, this creates a realistic path to command execution from untrusted or semi-trusted content, which can lead to malware execution, data exfiltration, or environment compromise.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill instructs in-place modification of README.md using sed-based section replacement without any backup, preview, confirmation, or validation of the matched range. In an agentic context, this can overwrite or delete user-authored documentation content if headings are formatted unexpectedly or the replacement range is broader than intended.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

| Flag | Behavior |
|------|----------|
| `--validate-only` | Run validation without generating GIF |
| `--skip-validation` | Bypass validation for rapid regeneration |

### Validation Exit Criteria

• Confidence: 82% confidence
• Finding: The `--skip-validation` flag enables bypassing the very checks intended to catch malformed or dangerous tape commands before recording. In a workflow that later consumes tape content and may execute commands or invoke recording sub-skills, this bypass increases the likelihood that unsafe or malicious content reaches execution stages unchecked. The danger is amplified by the skill's ability to process project-controlled tutorial assets.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

| Flag | Behavior |
|------|----------|
| `--validate-only` | Run validation without generating GIF |
| `--skip-validation` | Bypass validation for rapid regeneration |

### Validation Exit Criteria

• Confidence: 80% confidence
• Finding: Allowing validation to be skipped creates an unsafe default pathway in practice, because users under time pressure may choose the faster option and proceed directly to recording or related processing with unverified inputs. Given this skill's broader capabilities, bypassing validation weakens defense-in-depth and makes accidental execution of unsafe tape content more likely.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

|------|---------|
| 0 | Validation passed |
| 1 | Validation failed (errors found) |
| 2 | Validation skipped (--skip-validation) |

## Error Message Format

• Confidence: 92% confidence
• Finding: The documented '--skip-validation' behavior allows users to bypass all pre-flight checks before running VHS. In this skill, validation is the main safeguard against malformed tapes, stale binaries, and unsafe or invalid commands, so an easy bypass increases the chance that unreviewed commands from tape content get executed and produce misleading or harmful effects.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

|------|---------|
| 0 | Validation passed |
| 1 | Validation failed (errors found) |
| 2 | Validation skipped (--skip-validation) |

## Error Message Format

• Confidence: 88% confidence
• Finding: Treating validation skip as a normal documented path creates an unsafe default posture because operators are encouraged to bypass the control that checks command syntax, flags, and demo data integrity. In a workflow that later runs 'vhs "$tape_file"', this weakens defense-in-depth and makes accidental execution of bad or adversarial tape content more likely.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.