Security audit

code-workflow

Security checks across malware telemetry and agentic risk

Overview

This appears to be a real coding-workflow skill, but it gives the agent broad authority to persist plans, commit code, post GitHub updates, and optionally route artifacts into memory systems without enough explicit user control at each boundary.

Install only if you want an opinionated coding workflow that can write planning files, update local indexes, create branches and commits, and interact with GitHub issues/PRs. Use it cautiously on private or sensitive repositories, avoid --rag unless the receiver is trusted, and review any plan before it is posted externally or committed into repository history.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The script’s header claims it is warning-only and always exits 0, but the implementation returns exit 2 when undecided markers are found. In hook-driven workflows, operators may rely on the documented non-blocking behavior; this mismatch can unexpectedly block or alter execution flow, creating a denial-of-workflow condition and undermining trust in hook semantics.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill explicitly directs the agent to commit automatically after build and tests pass and says not to ask the user whether to commit. Creating commits is a state-changing action in the user's repository, and removing a user-facing confirmation step increases the risk of unintended source-control changes, especially when the agent misjudges task completion or scope.

Vague Triggers

High

Confidence: 93% confidence
Finding: The trigger list includes very common phrases such as "status", "review", "start", and "next task", which can cause the skill to activate on routine requests unrelated to this workflow. In a security-sensitive agent environment, overly broad activation increases the chance that the skill hijacks normal task flow, injects unnecessary instructions, or steers the agent into reading and prioritizing attacker-controlled documentation before doing the user’s intended work.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The domain-keyword trigger condition is ambiguous because it treats broad categories like filenames, tools, job names, and code names as equivalent triggers without strong scoping rules. This makes activation easy to induce with ordinary technical terms and can cause the agent to over-collect, over-read, or defer to unrelated plan/research files, which is especially risky because the skill text mandates reading all matches and treating them as authoritative workflow inputs.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The trigger phrase "create PR" is overly broad and can cause the skill to activate in many unrelated contexts where a user merely mentions pull requests. This increases the chance of unsolicited workflow steering, noisy suggestions, or accidental invocation during sensitive repository operations, though the content here does not directly execute dangerous actions.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill mandates creating and updating multiple local files such as task checklists, research/plan documents, backlog entries, and wiki indexes as a hard-stop default behavior, but it does not require an explicit user-facing notice that these writes will occur. In an agent setting, silent automatic file modification can violate user expectations, alter repository state, and create unintended persistence in tracking files beyond the task's immediate scope.

Missing User Warnings

High

Confidence: 95% confidence
Finding: The workflow requires querying knowledge stores and optionally dispatching research/plan artifacts to external receivers, yet it provides no mandatory consent, classification, or sanitization gate before potentially transmitting repository-derived content. Because research and plan files can contain proprietary code structure, issue metadata, security details, or internal design notes, this creates a meaningful risk of unintended data exfiltration to external memory or indexing systems.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.