AgentBench

• Outcome: Pass
• Latest audit: May 28, 2026, 6:29 AM
• Version:
  1.0.0

Overview

AgentBench is a disclosed benchmark skill that creates temporary task workspaces and local result files, with no artifact evidence of hidden data theft, persistence, or destructive behavior.

Install only if you are comfortable running a benchmark that creates many local files, initializes git repositories in temporary task directories, and writes result reports. Run it through the documented /benchmark commands in an isolated workspace, do not manually point setup.sh scripts at an existing project or home directory, and review any result file before uploading it to the leaderboard.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill instructs the agent to read and write files, access environment-dependent tools, and perform web requests, but the frontmatter declares no permissions or equivalent warning boundary. This creates a capability mismatch: users may invoke the skill without realizing it can touch local files, temporary workspaces, and network resources, increasing the chance of unintended data exposure or unsafe execution in a more privileged runtime.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The benchmark flow explicitly tells the agent to run task-local shell scripts such as setup.sh and teardown.sh. Because these scripts are part of task content and therefore untrusted input, executing them can lead to arbitrary command execution, file tampering, environment inspection, persistence, or network exfiltration, especially if the agent runs with broader host access than intended.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill directs the agent to use web_search and web_fetch during task execution, but the description does not warn users that benchmark runs may contact external services or transmit task-derived data. In context, benchmark tasks may include workspace files and prompts that could contain sensitive or proprietary information, so silent network use raises privacy and data-leakage risk.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script immediately changes into a user-supplied directory, initializes a Git repository, writes a requirements file, stages it, and creates a commit without any confirmation or safety checks. In an agent-executed benchmark context, this can unexpectedly modify arbitrary directories, alter existing repositories, and leave persistent state on disk, which is risky even if the benchmark author likely intended normal setup automation.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: This setup script initializes a Git repository, writes many files, creates commits, and adds a tag in whatever directory is passed as its first argument, but it provides no warning, validation, or confirmation before mutating the filesystem and repository state. In an agent-executed benchmark context, this can unexpectedly alter user workspaces or clobber existing repositories if the target path is wrong, making it an operationally dangerous script even if not overtly malicious.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script immediately changes into a user-supplied path and then performs extensive recursive file creation, Git initialization, staging, and commit operations with no validation, safety checks, or confirmation. If run against an unintended directory, it can overwrite files, pollute an existing repository, or modify sensitive locations, causing integrity loss and accidental data destruction.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The setup script unconditionally initializes a git repository, creates many files, and performs a commit inside a caller-supplied workspace. Even though this is typical benchmark scaffolding, it is still a real safety issue because running it against the wrong path can overwrite existing content, alter repository state, and persist changes without any interactive confirmation or built-in guardrails.

VirusTotal

66/66 vendors flagged this skill as clean.