Security audit

AppDeploy

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent deployment integration, but users should treat its API key and app-management actions as powerful administrative access.

Install this only if you want an agent to deploy and manage AppDeploy apps. Keep the .appdeploy API key out of repositories and logs, restrict its file permissions, rotate it if exposed, and require explicit confirmation before deleting apps, deleting secrets, changing domains, or reading deployed source snapshots.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The skill exposes capabilities well beyond straightforward deployment, including reading source snapshots, grepping code, listing and mutating app secrets, and deleting secrets/apps. In an agent setting, this materially expands the accessible attack surface: a prompt framed as deployment support could be used to inspect proprietary code or manipulate sensitive configuration unrelated to the immediate deployment task.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The src_glob, src_grep, and src_read tools allow broad post-deployment source-code discovery and retrieval, but the skill is described as a deploy/publish skill rather than a code-inspection skill. That mismatch increases the risk of over-collection: an agent could read sensitive application code, embedded tokens, business logic, or internal files under the pretext of deployment assistance.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: Permanent app deletion is a destructive capability that exceeds the stated purpose of deploying or publishing apps. If the skill is auto-invoked for general deployment requests, an agent error, prompt injection, or ambiguous instruction could irreversibly destroy a live application and associated operational state.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The trigger description is broad enough to match many routine website or app requests, which increases the chance the skill is invoked in situations where its powerful capabilities are unnecessary. In combination with deployment, deletion, source inspection, and secret-management tools, over-broad activation raises the risk of unintended privileged actions.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The setup flow instructs storing a bearer API key in a local .appdeploy file without clearly emphasizing that it is a sensitive credential with deployment and administrative power. Users may leave it in insecure locations, mishandle permissions, or accidentally expose it through backups, logs, shell history, or repository operations despite the brief .gitignore mention.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.