Security audit

LLMBooster

Security checks across malware telemetry and agentic risk

Overview

LLMBooster is a disclosed prompt-structuring skill with limited local helper state and no evidence of destructive, deceptive, network, or credential behavior.

Install this if you want analysis-style requests to use a structured Plan, Draft, Self-Critique, and Refine workflow. Be aware that its broad natural-language triggers may activate more often than expected, and it keeps simple local usage statistics in its own skill directory.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill declares no required permissions while the documented behavior and referenced components imply reading prompt/config files and writing persistent state such as usage statistics. This creates a transparency and policy-enforcement gap: operators may approve the skill as non-invasive even though it performs filesystem access, increasing the chance of unintended data access or persistence.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill is presented as a purely self-followed reasoning framework with no endpoint or automation, but the documentation describes stateful CLI handling, config loading, prompt file reads, and statistics persistence. This mismatch is dangerous because it can mislead users and reviewers about the true attack surface and operational behavior, causing them to trust or trigger code they did not expect to run.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The file claims the skill is only a self-applied thinking framework, yet it also defines executable command handling and state management. Security-sensitive documentation inconsistencies like this reduce informed consent and can bypass scrutiny because reviewers may evaluate it as inert prompt guidance rather than an active tool with side effects.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The statement 'no Python calls needed' is directly contradicted by the included Python command block for /booster handling. Contradictory instructions around code execution are risky because they obscure when code will run and what trust assumptions apply, making accidental execution of local automation more likely.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The documented natural-language triggers are broad phrases such as "help me analyze" and "detailed analysis," which commonly appear in normal user requests. This can cause the skill to activate unintentionally and alter model behavior or workflow without explicit user intent, increasing prompt-scope confusion and making downstream prompt injection or policy-bypass interactions easier to hide inside ordinary requests.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger conditions include broad phrases such as 'detailed analysis', 'help me analyze', and generic requests for evaluation or code review. Overbroad triggers can cause unintended activation in normal conversations, which is especially problematic here because activation may lead to reading local prompt files, changing state, or invoking CLI-related behavior the user did not intentionally request.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.