Security audit

code buddy配置管理

Security checks across malware telemetry and agentic risk

Overview

This is a real CodeBuddy configuration manager, but it can install packages, import remote configs, and change persistent agent settings with too little review or scoping.

Install only if you intend to delegate CodeBuddy configuration changes to this skill. Use trusted URLs and known package names, review MCP JSON and skill/plugin changes before applying them, avoid search-derived installs unless you verify the source, and treat global scope or CLI package installs as high-impact changes.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The model status check reads sensitive environment variables such as OPENAI_API_KEY, OPENAI_BASE_URL, and DEEPSEEK_API_KEY to infer installation state, even though this script is framed as a configuration-status checker. Accessing secrets for unrelated presence detection expands the script's privilege surface and can disclose whether credentials exist, which is unnecessary and privacy-invasive in an agent-managed context.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The script accepts an arbitrary URL, downloads JSON over the network, and merges it directly into the MCP configuration without trust validation, origin allowlisting, signature checking, or user confirmation. In the context of a configuration manager, this can be abused to install attacker-controlled MCP server definitions that later execute arbitrary commands when the MCP entry is used.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The CLI verification logic executes the user-supplied binary name via `"$CONFIG_NAME" --help` or `--version`, which turns a passive verification step into code execution. In this skill's context, configuration names may refer to newly installed or attacker-controlled binaries on PATH, so verification can trigger arbitrary code with the user's privileges even when the goal is only to confirm installation state.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The trigger conditions are broad enough to match common requests about configuring, installing, updating, or checking components, which increases the chance the skill activates in situations where the user did not intend this specific automation. In this skill, accidental invocation is more dangerous because the workflow can proceed to internet lookup, installation, and configuration changes.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The skill is designed to automatically search the internet, download configuration artifacts, and write them into local or global CodeBuddy locations, but it does not require a trust warning, source validation, or explicit user consent before acting. That combination exposes users to supply-chain risk, malicious config ingestion, and unintended persistence changes from untrusted remote sources.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The install/update workflow includes downloading remote content, creating directories, writing configuration, and installing dependencies, yet it does not mandate explicit confirmation before these state-changing actions. In a config-manager skill with shell access, this can directly lead to unauthorized system changes, malicious package installation, or persistence in user and project environments.

Missing User Warnings

High

Confidence: 95% confidence
Finding: The model configuration flow instructs searching for API setup details and guiding users to configure API keys and environment variables without any warning about secret handling, storage location, masking, or leakage risks. This can cause users or downstream tooling to place secrets into insecure files, logs, shell history, or project directories where they may be exposed.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The script accesses sensitive environment variables without any user-facing notice, consent, or disclosure. In an agent skill that auto-detects and verifies developer tooling, silent secret inspection is risky because users may not expect a status command to probe credentials, and downstream logs or behavior can reveal credential presence.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The script performs package installation and upgrade actions immediately, including global installs and upgrades, without an interactive confirmation or a clear dry-run/safety gate. In an agent skill context, this is more dangerous because an automated system could modify the host environment, install untrusted packages based on user-controlled tool names, or unexpectedly alter existing software state.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: This path combines network retrieval with immediate application of the downloaded JSON to a local configuration file, without any explicit safety prompt or trust boundary. That makes social engineering and remote configuration injection easier, especially because the installed MCP entries can define commands and arguments that may execute later in the user's environment.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.