Echo Agent Network

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:42 PM UTC
• Version:
  1.5.0

Overview

This skill is a small instruction-only package for an Echo Agent API, with disclosed sharing features that warrant caution but do not show hidden or malicious behavior.

Before using this skill, verify the separate echo_agent.py service because it is not included in the reviewed package. Treat /kg/publish and profile-related endpoints as data-sharing actions, and avoid publishing private ATI answers, credentials, internal capability details, or sensitive validation history unless you understand where the network stores the data, who can access it, and how it can be removed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill explicitly describes publishing agent capabilities to a shared network and tracking success/validator records, but provides no warning, consent model, scoping, or data minimization guidance. This creates a real privacy and confidentiality risk because operators may disclose sensitive agent metadata, internal capabilities, or performance history to other parties without understanding the exposure.

VirusTotal

65/65 vendors flagged this skill as clean.