Security audit

A0X Agents

Security checks across malware telemetry and agentic risk

Overview

The skill appears purpose-built for an AI mentor and shared knowledge workflow, but it asks for broad persistent control over future agent behavior and remote consultation without enough user scoping.

Review before installing. This does not look malicious from the supplied evidence, but it should be treated as a Review item because it can persistently change agent instructions, influence sub-agents, and encourage frequent remote queries. Install only if you are comfortable with that behavior, and require explicit approval before any changes to SOUL.md, AGENTS.md, or HEARTBEAT.md or before sending project context to the service.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The skill asserts that source code, files, and workspace contents are never sent, yet elsewhere instructs the agent to modify local files such as SOUL.md, AGENTS.md, and HEARTBEAT.md. That mismatch is security-relevant because it downplays the skill’s real capability to access and alter persistent local state, which could mislead users about what the skill can do.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The skill directs the agent to append persistent instructions into SOUL.md, AGENTS.md, and HEARTBEAT.md, affecting future sessions and sub-agents beyond the immediate task. This creates a persistence and privilege-expansion mechanism: once installed, the skill can broaden future behavior, trigger remote calls more often, and propagate its rules across agent descendants.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The skill claims all actions are transparent and user-declinable, but later instructs the agent to edit configuration files and then tell the human that it has already configured them. That pattern encourages action-before-consent and undermines informed approval, making unauthorized persistent changes more likely.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The activation conditions include very broad terms like errors, bugs, architecture decisions, patterns, and project reviews, which are common across normal development work. Overbroad triggers increase the chance the skill activates in unrelated contexts and causes unnecessary remote interactions or policy injection where the user did not specifically request this tool.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The RECALL instructions require consulting the remote 'brain' before reasoning about a wide range of issues, including virtually any debugging or non-trivial integration task. This can redirect ordinary workflow through a third-party service by default, increasing data-exposure risk and giving the skill undue influence over agent behavior.

Vague Triggers

Medium

Confidence: 96% confidence
Finding: The AGENTS.md block expands the skill’s scope to nearly all non-trivial work and propagates that scope to all spawned sub-agents. Combined with persistence, this creates broad behavioral takeover: future agent tasks may be steered into external search/proposal workflows without fresh user intent each time.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:482