Exec Guard

• Outcome: Malicious
• Latest audit: Jul 10, 2026 · 1:48 AM UTC
• Version: 1.0.0

Overview

This skill is a plausible command-safety checker, but its optional remote LLM path and unsafe allow overrides make it risky for a security guard.

Install only if you treat it as an advisory checker, not a reliable enforcement barrier. Avoid `--llm` unless you trust the endpoint and are comfortable sending full command text there, and do not rely on this version to block destructive compound shell commands.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill advertises and demonstrates shell-command classification, file input, and optional HTTP access to an LLM endpoint, but declares no corresponding permissions. Missing permission declarations weaken policy enforcement and informed consent, making it easier for an agent runtime to grant broader capabilities than users expect.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The documented behavior expands beyond local command classification by transmitting command contents to an HTTP LLM service and, per the finding, allowing commands when the LLM request fails. This creates both data-exposure risk and a fail-open safety bypass, which is especially dangerous for a guard component intended to block risky shell execution.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: When --llm is enabled, the classifier sends the full shell command to an HTTP endpoint, which may expose sensitive commands, credentials, file paths, or operational details outside the local decision path. For a guard tool whose stated purpose is local command safety classification, undisclosed command exfiltration materially expands the trust boundary and creates privacy and data-handling risk.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: Optional network submission is not necessary for the core purpose of a pre-execution guard and introduces an avoidable attack surface, including data leakage and dependency on an external service for security decisions. Even if the endpoint is localhost by default, the URL is configurable and there are no trust, authentication, or transport safeguards shown.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The LLM path fails open: if the LLM endpoint is unavailable or errors, llm_classify returns an allow verdict. In a security guard, failure to classify should default to deny or at least ask, otherwise attackers can bypass the extra inspection simply by causing the LLM check to fail.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The code transmits raw shell commands to an HTTP endpoint without any user-facing warning at runtime, which can leak secrets embedded in commands such as API keys, bearer tokens, database URIs, or internal hostnames. Lack of disclosure is especially problematic in a command-guard skill because users may reasonably expect analysis to remain local and confidential.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

(r"env\s+\|\s+curl", "env_leak", 0.60),
]

SAFE_OVERRIDES = [r"rm\s+-rf\s+/tmp/", r"rm\s+-rf\s+\.git/", r"rm\s+-rf\s+node_modules", r"rm\s+-rf\s+__pycache__", r"find\s+\.\s+-name"]

def classify(command: str) -> dict:
    cmd_lower = command.lower().strip()

• Confidence: 93% confidence
• Finding: rm\s+-rf\s+/tmp/", r"rm\s+-rf\s+\.git/"

VirusTotal

1/65 vendors flagged this skill as malicious, and 64/65 flagged it as clean.

Static analysis

Detected: malicious.crypto_mining

Possible crypto mining behavior detected.

Critical

• Code: malicious.crypto_mining
• Location: classifier.py:22