Security audit

Luban Skill

Security checks across malware telemetry and agentic risk

Overview

This skill is a real skill optimizer, but it can edit and persist changes across skill repositories more broadly than its simple review-style triggers make clear.

Install only in skill repositories where you are comfortable with automated edits, backup files, git operations, and persistent optimization history. Prefer explicit review-only or dry-run use, avoid broad "optimize all skills" commands unless intended, and disable or gate live URL checking and scheduled/event-driven maintenance in sensitive workspaces.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (21)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill declares broad operational behavior—reading and modifying SKILL.md files, creating backups, writing TSV/JSON/Markdown artifacts, invoking git, and performing security/link checks—yet no explicit permissions or safety boundary are declared up front. In an agent ecosystem, this gap can cause users or orchestrators to invoke it as if it were a simple reviewer, while it actually mutates repositories and touches multiple files.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared purpose frames the skill as a skill optimizer/reviewer, but the documented behavior extends to repository mutation, security scanning, file generation, history analysis, possible URL checking, and cross-skill state management. This mismatch is dangerous because users may grant trust or invoke it for low-risk review while it performs materially higher-risk actions with broader reach.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The workflow goes beyond review into broad repository mutation across skill directories, including branches, backups, generated artifacts, and history files. In context, this is more dangerous because the trigger phrases are broad and the skill is positioned as a general optimizer, increasing the chance of unintended invocation against real repositories.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: Automatically generating a baseline reference skill file is a content-creation and filesystem mutation capability not obvious from the skill's stated user-facing role. That increases risk of silent repository changes, especially in environments where users expect analysis only.

Context-Inappropriate Capability

Medium

Confidence: 87% confidence
Finding: Maintaining cross-skill registries and meta-learning files creates persistent state outside the immediate target skill, expanding blast radius and privacy/traceability concerns. In context, this is riskier because the skill can aggregate history across multiple skills without that being prominently disclosed in the top-level purpose.

Intent-Code Divergence

High

Confidence: 94% confidence
Finding: The skill claims it will not introduce new dependencies or files, but later instructions explicitly create multiple files when absent. This contradiction undermines safety expectations and can be exploited to justify broader write behavior than the user agreed to, including artifact sprawl across repositories.

Intent-Code Divergence

Medium

Confidence: 82% confidence
Finding: The constraint promises git-branch-based rollback, but Quick mode bypasses branches and uses file-copy backups instead. This inconsistency weakens auditability and recovery guarantees, making destructive or confusing edits more likely during unintended invocation.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The reference introduces a distinct `skill-evolution` capability with dispatching, autonomous maintenance modules, and broader lifecycle actions that exceed a narrowly scoped skill-review/optimization role. Even though framed as methodology, this kind of embedded design guidance can cause the agent to adopt expanded authority and behavior beyond user expectations, increasing the risk of unintended autonomous maintenance or editing workflows.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: This section authorizes autonomous external knowledge retrieval, validation, and reference updates, which is broader than a skill-quality review function and can introduce untrusted external content into the skill corpus. That creates supply-chain and scope-creep risk, especially if updates are later consumed as trusted guidance without human review.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The document describes automatic file editing, regression testing, rollback decisions, and persistence of generated tests, which materially expands the skill from review into active code/content modification. If followed by an agent, this can lead to unauthorized changes, durable state mutation, and self-reinforcing behavior that persists beyond the original request.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The file defines event-driven and scheduled automation that can modify or create skill artifacts beyond a narrow 'review/score/optimize on request' scope, including automatic regression actions after edits and periodic background tasks. In an agent setting, this broadens authority from advisory analysis to persistent autonomous workflow execution, increasing the risk of unintended file changes, surprise side effects, and privilege overreach.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The script is described as a static scanner, but `check_urls()` performs live outbound HTTP requests to every discovered external link. This can leak environment metadata such as IP/network reachability, create unintended network side effects, and allow a crafted skill to force the scanner to contact attacker-controlled infrastructure during analysis.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The trigger list includes very broad activators such as “luban” and “小鲁班”, plus generic phrases like “帮我改skill” and “看看…怎么样”, which can cause accidental invocation outside explicit optimization intent. In an agentic skill that performs scoring and automated modification, unintended activation increases the risk of unreviewed file changes, unnecessary execution of analysis modules, or the skill hijacking unrelated conversations.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The trigger list contains broad natural-language phrases such as 'luban' and generic requests like '帮我改skill' or 'skill review', which can cause unintended activation in unrelated conversations that merely mention those terms. In an agent skill that can evaluate, modify, or audit other skills, accidental invocation increases the risk of unauthorized or surprising actions, especially if downstream behavior includes file access or automated optimization.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The trigger list includes broad natural-language phrases such as review/score/optimize variants that could match ordinary conversation and invoke a repository-mutating skill unintentionally. Because the skill can edit files, create artifacts, and run git-oriented workflows, accidental activation materially raises risk.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The top-level description does not clearly warn that the skill may create, modify, and persist multiple repository files during optimization. In context, this omission is dangerous because users may invoke it expecting advisory output, not filesystem and git mutations.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The trigger examples are broad and overlap with common user phrases such as checking or improving a skill, without clear exclusions or routing constraints. This increases the chance of accidental activation and unintended delegation into optimization or maintenance behavior when the user may have meant a narrower or different task.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger phrase "这个技能有问题 / 不对" is overly broad and can be matched during ordinary conversation, causing the skill to activate when the user is merely commenting on a skill rather than explicitly requesting this agent. In an autonomous optimization skill, accidental invocation can lead to unintended evaluations, edits, or workflow changes, increasing the chance of unsafe or surprising behavior.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The invocation table defines several phrases that are ambiguous and lack activation guards, including broad operational requests like optimizing all skills or checking skill health. Because this skill appears capable of making repository and workflow changes, loose activation criteria raise the risk of unintentional execution, scope creep, and actions affecting multiple skills without clear user consent.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The document describes deletion, restructuring, and diagnostic writes to skill files without consistently foregrounding that these are mutating operations. In a tool-using agent, insufficient disclosure of write/delete behavior can mislead operators and enable unintended destructive changes, especially when paired with analyzer-driven recommendations.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: MUSE is documented to auto-trigger after any edit and to create or append testing artifacts such as tests.yaml, but it does not prominently require explicit user awareness or consent for those writes. Automatic persistence after ordinary edits can create hidden side effects, unexpected file growth, and unauthorized repository modifications in environments where the agent has write access.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.