Security audit

cargo-storage

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly a coherent Cargo storage-management guide, but it includes risky token exposure plus destructive and bulk-export actions without enough guardrails.

Install only if you are comfortable letting an agent operate on Cargo workspace storage. Before using it, require explicit confirmation for model or column deletion, avoid broad exports unless needed, prefer scoped or newly created low-permission ingest tokens, avoid printing token-bearing URLs into logs or chat, and rotate any token that may have been exposed.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The skill includes instructions to retrieve a workspace API token and manually construct an ingest webhook URL, which expands the skill from storage management into credential handling and authenticated endpoint generation. This is dangerous because it encourages exposing a live bearer-style secret in command output and URLs, increasing the risk of token leakage through terminal history, logs, screenshots, or downstream tooling.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The documentation presents model removal as a routine command without any warning that deletion may be irreversible or disruptive. In an agent context, omission of confirmation and rollback guidance increases the likelihood of accidental destructive actions against production data structures.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The webhook ingestion instructions place an API token directly into a URL and provide commands that print that full secret-bearing URL to stdout. This is dangerous because URLs are commonly stored in shell history, logs, browser history, monitoring systems, and chat transcripts, making credential exposure and unauthorized ingestion more likely.

Missing User Warnings

Low

Confidence: 74% confidence
Finding: The skill documents bulk export via signed URL without any warning about data sensitivity, access scope, or retention of exported files. In practice, this can enable excessive data exfiltration or accidental sharing if an agent uses full-table exports where a limited query or preview would suffice.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The example shows a destructive `column remove` operation without any warning that deleting a column can break dependent queries, computed/metric/lookup columns, automations, or permanently remove data/schema elements. In a storage-management skill that directly modifies workspace models, omission of safety guidance increases the chance of accidental destructive actions by users or downstream agents.

Missing User Warnings

Low

Confidence: 91% confidence
Finding: The documentation includes a direct model deletion command with only a dependency-related note, but no explicit warning that the operation is destructive and may permanently remove data or break downstream workflows. In a storage-management skill, users may copy-paste commands verbatim, so omission of a clear caution increases the risk of accidental destructive actions.

Ssd 3

High

Confidence: 98% confidence
Finding: The instructions explicitly derive and echo a usable ingest URL containing a live workspace API token in plain text. This is a strong secret-disclosure issue because the token becomes immediately exposed to anyone with access to console output, logs, recordings, or copied transcripts, enabling unauthorized record ingestion and possibly broader workspace access depending on token scope.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.