Security audit

n8n

Security checks across malware telemetry and agentic risk

Overview

The skill appears to be a self-improving agent framework demo, but its documentation claims persistent operation, broad tool/server reach, and autonomous evolution without clear safeguards or scoping.

Review this carefully before installing. Treat the self-improvement, persistent council, and production-server access claims as high-risk unless you can verify they are disabled by default, require explicit approval, run only in a sandbox, keep audit logs, and provide rollback/stop controls. Do not connect production credentials or broad MCP/A2A tools until the behavior is scoped and tested.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill metadata makes strong claims about self-improvement, resilience, and security controls, but the provided file contains no supporting implementation or documentation. This kind of description-behavior mismatch is dangerous because it can cause operators to trust nonexistent safeguards, deploy the skill in sensitive environments, or approve risky side effects under false assumptions of protection.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The example claims agents terminate after task completion, but every Specialist instance is appended to a class-level global registry and never removed. In an agent framework context, this creates a misleading lifecycle model and can cause unbounded memory growth, stale object retention, and unintended access to prior agent state if this pattern is copied into production systems.

Intent-Code Divergence

Low

Confidence: 84% confidence
Finding: The code advertises '17 dharmic security checks' but only performs a simulated pass over five named gates, which overstates the real security controls present. In a security-themed agent skill, this can mislead developers into trusting protections that do not exist, increasing the chance that unsafe patterns are adopted under false assurance.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The file-level docstring presents the example as enabling real overnight self-improvement, but the implementation is explicitly a simulation driven by print statements and random values. In an agent framework, overstating autonomous self-modification capabilities can mislead operators into trusting nonexistent safeguards, review flows, or research/testing behavior, creating unsafe deployment assumptions.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The line 'This is not metaphorical. It's operational.' directly asserts real functionality even though the script only simulates activity and invents results with randomness. This kind of deceptive operational claim is dangerous because users may rely on fictitious autonomous review and safety controls when evaluating or deploying the skill.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The README explicitly promotes a system that 'rewrites itself' and runs overnight research cycles, but it does not clearly disclose the security, change-control, or review implications of autonomous code modification. In an agent framework context, self-updating behavior can introduce unreviewed code paths, prompt-driven drift, supply-chain compromise, or unsafe privilege use, making this materially risky rather than mere marketing language.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The README advertises native access to '10,000+ production servers' via MCP/A2A and frames it as secure, but provides no adjacent warning about credential handling, least-privilege access, data exposure, destructive actions, or tenant impact. In a skill meant to orchestrate agents and tools, this kind of broad operational reach materially raises the risk of misuse, accidental lateral movement, and over-trust by users.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill explicitly describes nightly self-scanning, testing, proposing updates, and evolving itself, but does not present explicit safeguards, user approval checkpoints, scope limits, or rollback warnings near the feature description. In a skill that markets autonomous overnight evolution as operational, omission of clear warnings can lead users to enable unattended code or configuration changes they do not fully understand, increasing the risk of persistence, unsafe modifications, and supply-chain style compromise.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The quick-start path tells the user to install, verify, and activate the agent, then states 'Done' and immediately lists persistent capabilities, but it does not warn that activation may start long-running or continuous behavior. Because the skill later advertises a 24/7 persistent council and always-on execution, this omission can mislead users into launching background activity with ongoing cost, data access, or autonomous action they did not anticipate.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The advanced example enables 'auto_evolution' with research cycles, integration tests, and validation, then states the skill now improves itself, but it gives no warning about autonomous system modification or the risks of unattended changes. Example code strongly shapes user behavior, so presenting self-modifying capability as a normal recipe without guardrails increases the chance of unsafe deployment, especially in environments with broad file, tool, or network permissions.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.