Security audit

adversarial-spec

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent spec-writing pipeline, but it gives model/provider commands broad repository mutation authority and ships unsafe install/provider examples that need review before use.

Install only if you trust the publisher and repository. Prefer cloning and reviewing a pinned version instead of using the curl | bash one-liner. Run it on a clean branch or disposable worktree, review git diff before merge, avoid deep-research for confidential briefs, and use sandboxed provider commands instead of dangerous approval-bypass modes.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill advertises file, shell, environment, and git-driven behavior but does not declare any permissions or capability boundaries. This creates a transparency and policy-enforcement gap: an orchestrator or reviewer may treat it as lower risk than it really is, while the documented workflow clearly includes command execution, filesystem modification, and repository state changes.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 82% confidence
Finding: The declared description frames the skill as a spec writer, but the documentation indicates broader operational behavior such as provider selection logic, artifact generation, branch manipulation, and potentially additional gating/automation behavior. That mismatch is dangerous because operators may approve or invoke the skill under an incomplete trust model, exposing repositories, CI state, or local filesystems to actions they did not expect.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The skill explicitly acknowledges an open issue where the writer can commit arbitrary repository changes via `git add -A`, not just `spec.md`. In an adversarial or prompt-injection scenario, that enables unintended staging and committing of unrelated source modifications, secrets, or destructive changes under the guise of specification generation.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The script advertises and implements an optional `--deep-research` mode that goes beyond local spec generation and can contact external providers. In a spec-writing skill, that materially expands the trust boundary and data-exposure surface, especially because briefs may contain proprietary or sensitive product details.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: `_run_research` constructs a query containing the full brief and sends it to a provider command via `runner.run_research`, which can exfiltrate sensitive inputs outside the local environment. The feature is non-fatal operationally, but from a security perspective it still creates confidentiality risk because the brief may include unreleased plans, credentials, internal architecture, or customer data.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: Delegated mode fans the task out to multiple provider-driven worker stages and the comments acknowledge the default commands may be full agentic CLIs that can run shell commands or edit files. Even with some filesystem isolation for worker stages, this significantly broadens execution and data-sharing scope beyond a simple spec writer and increases the chance of unintended side effects, prompt injection propagation, or sensitive brief dissemination to multiple external agents.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The installation instructions tell users to execute a remote script directly from GitHub via a shell pipe, with no integrity verification, pinning, or warning. If the remote content, network path, repository, or referenced branch is compromised, users can run attacker-controlled code immediately on their machine.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The document explicitly notes that the wrapper defaults to dangerous permission-skipping behavior and says to use that default except for untrusted input, but it does not provide strong warnings, guardrails, or a safer default. In a git-aware adversarial-spec pipeline, this increases the chance that model-generated actions run with excessive filesystem or command permissions, which can lead to unauthorized file changes, data exposure, or destructive local actions if prompts or inputs are adversarial.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: At the call site, when `--deep-research` is enabled, the code passes the full `brief_text` into `_run_research` and then may enrich downstream prompts with returned evidence, but there is no explicit user-facing warning at this point about external disclosure. In the context of a spec authoring tool, users are likely to provide confidential planning material, making silent transmission to a networked provider particularly risky.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The spec includes example provider commands that invoke powerful model tooling with dangerous bypass flags such as `--dangerously-bypass-approvals-and-sandbox`. In this skill context, those strings are intended to be loaded from external config and executed by the pipeline, so normalizing unsafe examples materially increases the chance operators deploy commands that disable safety boundaries and permit destructive filesystem or command execution.

External Script Fetching

Low

Category: Supply Chain
Content: Requires the `adversarial-common` sibling repo (shared engine). One-line install: curl -fsSL https://raw.githubusercontent.com/chpomob/adversarial-spec/main/scripts/install.sh | bash or, from an existing checkout:
Confidence: 96% confidence
Finding: curl -fsSL https://raw.githubusercontent.com/chpomob/adversarial-spec/main/scripts/install.sh | bash

External Script Fetching

Low

Category: Supply Chain
Content: #!/usr/bin/env bash # Install adversarial-spec with its single dependency: adversarial-common (sibling layout). # Usage: # Bootstrap (from anywhere): curl -fsSL https://raw.githubusercontent.com/chpomob/adversarial-spec/main/scripts/install.sh | bash # From a checkout: bash scripts/install.sh [TARGET_DIR] # Target layout (siblings required): # <TARGET>/adversarial-spec (this skill)
Confidence: 97% confidence
Finding: curl -fsSL https://raw.githubusercontent.com/chpomob/adversarial-spec/main/scripts/install.sh | bash

Chaining Abuse

High

Category: Tool Misuse
Content: Requires the `adversarial-common` sibling repo (shared engine). One-line install: curl -fsSL https://raw.githubusercontent.com/chpomob/adversarial-spec/main/scripts/install.sh | bash or, from an existing checkout:
Confidence: 98% confidence
Finding: | bash

Chaining Abuse

High

Category: Tool Misuse
Content: #!/usr/bin/env bash # Install adversarial-spec with its single dependency: adversarial-common (sibling layout). # Usage: # Bootstrap (from anywhere): curl -fsSL https://raw.githubusercontent.com/chpomob/adversarial-spec/main/scripts/install.sh | bash # From a checkout: bash scripts/install.sh [TARGET_DIR] # Target layout (siblings required): # <TARGET>/adversarial-spec (this skill)
Confidence: 99% confidence
Finding: | bash

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.