Nvidia Agent Fleet

• Outcome: Review
• Latest audit: Jul 1, 2026 · 8:03 PM UTC
• Version: 1.1.2

Overview

The skill is a real NVIDIA model dispatcher, but it handles API keys in a risky way by executing a local shell startup file and reading local config files during automatic credential discovery.

Review before installing. Use this only if you are comfortable sending prompts to NVIDIA APIs and letting the skill look for NVIDIA credentials locally. Prefer setting NVIDIA_API_KEY explicitly, and avoid relying on ~/.zshrc discovery because the skill executes that file while searching for the key.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (8)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if os.path.exists(zshrc):
        try:
            import subprocess
            result = subprocess.run(
                ["bash", "-c", f"source {zshrc} && echo $NVIDIA_API_KEY"],
                capture_output=True, text=True, timeout=5
            )

• Confidence: 93% confidence
• Finding: The code spawns `bash -c` to source `~/.zshrc`, which executes arbitrary shell code from a user-controlled startup file merely to recover an API key. This turns credential discovery into code execution and can trigger unintended commands, side effects, or abuse if the shell rc file is malicious or modified.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill advertises capabilities that imply environment access, file access, network use, and shell interaction, but declares no permissions or user-facing trust boundary. In this context, that is dangerous because the documented API-key auto-discovery reads local configuration sources for secrets without explicit consent, expanding the skill’s effective access beyond what the user would reasonably expect.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: This is a true security issue because the skill’s stated purpose is model routing/orchestration, but it also searches local shell and app config files for API keys and sets environment variables from discovered secrets. That behavior materially expands data access and secret-handling risk; users invoking an orchestration skill would not reasonably expect local secret harvesting from files like ~/.zshrc or application configs.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The dispatcher performs broad credential discovery across environment variables, shell startup files, and unrelated local configs despite its stated purpose being agent selection and dispatch. This is dangerous because it expands access to local secrets beyond what is necessary and creates hidden credential collection behavior in a component that users would not expect to inspect their workstation for keys.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: Omitting a clear warning that the skill may inspect ~/.zshrc and local configuration files for API keys prevents informed consent for secret access. In a skill that also performs networked model calls, undisclosed secret discovery increases the chance that sensitive credentials are accessed or mishandled without the user understanding the exposure.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill reads `~/.zshrc` and local OpenClaw config files to locate secrets without any user-facing disclosure. Even if intended for convenience, silent secret discovery is risky because users may unknowingly expose credentials stored for other tools and cannot make an informed trust decision.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: User task content is sent to an external NVIDIA API, but the code provides no explicit disclosure, confirmation, or data-handling notice at the call site or CLI level. In an agent framework, prompts may contain sensitive code, proprietary data, or internal documents, so silent transmission to a third party creates privacy and compliance risk.

Unvalidated Output Injection

High

• Category: Output Handling

Content

if os.path.exists(zshrc):
        try:
            import subprocess
            result = subprocess.run(
                ["bash", "-c", f"source {zshrc} && echo $NVIDIA_API_KEY"],
                capture_output=True, text=True, timeout=5
            )

• Confidence: 91% confidence
• Finding: The shell command uses `bash -c` with interpolated command text and executes output-producing shell initialization logic whose stdout is then trusted as a credential source. This allows untrusted shell config content to influence program behavior and can combine code execution with output spoofing or command side effects.

Static analysis

No suspicious patterns detected.