Security audit

Skill 管理器

Security checks across malware telemetry and agentic risk

Overview

This appears to be a local skill-management tool, but its file access and deletion controls appear too broad for safe installation without review.

Review this before installing. Use it only in an isolated workspace or with backups until path validation and delete safeguards are fixed. Avoid exposing its local web UI beyond localhost, and prefer dry-run repair commands before allowing any --fix or delete operation.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

Low

Confidence: 83% confidence
Finding: The page loads Chart.js from a third-party CDN, which introduces an unnecessary external trust dependency into an admin interface for managing local skills. If the CDN, dependency, or delivery path is compromised, malicious JavaScript could execute in the context of the skill manager UI and interact with its authenticated API endpoints.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The endpoint joins untrusted skill_name directly into a filesystem path and then reads SKILL.md plus recursively lists files under that path. An attacker can supply traversal sequences such as ../ to escape ~/.workbuddy/skills and read arbitrary files or enumerate directories accessible to the server process.

Description-Behavior Mismatch

Critical

Confidence: 99% confidence
Finding: The delete route constructs skill_path from untrusted input and passes it to shutil.rmtree after only checking that the directory exists. Because traversal is not blocked, a crafted skill_name can target directories outside the managed skills folder, leading to arbitrary recursive deletion; the agent_created check is also based on attacker-controlled metadata in the target's SKILL.md.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The README advertises an automatic 'repair' capability that cleans up files such as leftover .zip and .backup artifacts, but it does not warn users that invoking this feature may modify or delete files on disk. In a skill-management tool that operates over user skill directories, undocumented filesystem changes can lead to accidental data loss or unsafe use by operators who assume the action is non-destructive.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The quick-start example includes a --fix command without any caution that it may perform destructive filesystem changes. Users often copy-paste quick-start commands verbatim, so presenting a modifying command as a routine example materially increases the risk of unintended deletion or alteration of local skill data.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.