Security audit

Node Transfer

Security checks across malware telemetry and agentic risk

Overview

The skill appears built for legitimate node-to-node file transfer, but it includes under-scoped code execution and network/file-write behaviors that users should review before installing.

Install only if you trust the publisher and will use it on trusted networks and trusted paths. Treat the generated transfer URL and bearer token as secrets, avoid untrusted target directories for installation checks, verify any generated PowerShell before running it remotely, and choose destination paths where overwrites or permission changes cannot damage important data.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: The script claims to perform a passive installation check, but loadVersionInfo() executes targetDir/version.js via require(). Because targetDir is user-supplied, an attacker can place arbitrary JavaScript in version.js and get code execution merely by invoking the checker, violating the expectation of a read-only integrity check.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The main flow accepts an arbitrary directory from the command line and passes it into checkInstalled(), which in turn requires a file from that directory. This means a caller can point the script at any attacker-controlled path and trigger execution of local code, making the "installation check" an implicit code loader.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The proposal recommends auto-deploying helper scripts and writing transferred data to destination paths, but it does not clearly warn users that this causes code deployment and filesystem modification on remote nodes. In an agent skill context, that omission can lead operators to trigger remote changes they did not fully intend, especially if source/destination paths are user-controlled or sensitive.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The example presents cross-node file transfer over HTTP as a native capability without an explicit warning about confidentiality and integrity risks. Because the document itself later lists encryption as an open question, readers may reasonably infer plaintext or unauthenticated transport is acceptable, which could expose transferred data or allow tampering on untrusted networks.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The report instructs operators to run PowerShell with ExecutionPolicy Bypass and to execute a deployment script remotely via nodes.invoke, but it does not include any warning, trust boundary guidance, or validation steps before execution. This is dangerous because it normalizes bypassing local script protections and remote code execution on a node, increasing the chance of accidental execution of tampered or incorrect scripts with system-wide effects.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The transfer example writes directly to fixed destination paths such as /incoming/file.zip without any warning about overwriting existing files, permissions, or data modification. In operational use, this can lead to accidental data loss, corruption, or unintended replacement of files if the destination already exists or points to a sensitive location.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: During version checking, the script executes a local JavaScript file from the inspected directory without any warning that code will run. Even if intended for convenience, this is dangerous because users reasonably expect a verification utility to inspect files, not execute them, increasing the chance of accidental arbitrary code execution.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The script intentionally binds an HTTP server to 0.0.0.0 and prints both the transfer URL and bearer token to stdout, making the selected file reachable by any host that can access the listening interface. While a strong random token is used, there is no user-facing warning, interface restriction, TLS, or secondary confirmation, so accidental exposure, token leakage via logs, shell history, or agent output handling can result in unintended file disclosure.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.