Security audit

workflow-improvement

Security checks across malware telemetry and agentic risk

Overview

This workflow-improvement skill is mostly coherent, but it normalizes automatic GitHub issue creation and posting tooling learnings to a fixed external repository without a clear consent or redaction gate.

Review this skill carefully before installing. It is not showing destructive or deceptive behavior, but you should only use it in repositories where creating GitHub issues and posting tooling learnings externally is acceptable. Require a preview/redaction step for issue bodies and discussion posts, and avoid using it on private or sensitive work unless the workflow is changed to make external sharing opt-in.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The skill directs users to post tooling learnings to a fixed external GitHub repository, which creates an outbound data-sharing path unrelated to the core local workflow-improvement function. Because the instruction is framed as the preferred or default destination and lacks content-scoping, sanitization, or user-consent safeguards, it can cause leakage of internal workflow details, repo metadata, or operational practices to a third party.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The manifest presents this as a workflow evaluation/improvement skill, but the body also mandates cross-repository publication to a specific external project. That mismatch increases the risk of confused-deputy behavior: a user invoking a local improvement skill may not expect it to recommend or normalize disclosure of information outside the current repository or organization.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger list contains broad, common terms such as 'workflow', 'agents', 'skills', and 'confusing', which can cause the skill to activate in many unrelated contexts. Overbroad activation is dangerous here because this skill contains prescriptive instructions that may steer users toward unnecessary repository inspection, git history review, or external knowledge publication when they did not intend to invoke such behavior.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The skill instructs posting observations to a public GitHub Discussions repository without an explicit warning that content may leave the local repo or organization. In the context of a workflow-analysis skill, collected observations may include sensitive operational details, internal failures, architecture decisions, or names of private components, making silent external sharing particularly risky.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The module makes GitHub issue creation automatic by default for workflow-derived items, which can include sensitive internal context such as file paths, code details, PR references, or operational notes. Because there is no upfront warning, confirmation step, or explicit consent gate before transmitting that content to GitHub, users may unintentionally exfiltrate non-public information to an external system.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.