Security audit

Senseguard

Security checks across malware telemetry and agentic risk

Overview

SenseGuard looks like a local skill scanner, not malware, but it can overstate its semantic-analysis results and mark unperformed analysis as safe.

Review before relying on this skill for security decisions. It is reasonable to use as a local rule-based scanner, but do not treat SAFE semantic results as a completed LLM audit unless you manually process and integrate the generated Layer 2 prompt. Use narrow scan targets and consider a controlled `--cache-file` for private skills.

SkillSpector

By NVIDIA

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 83% confidence
Finding: The skill claims semantic security scanning but the described behavior suggests broader scanning, caching, reporting, and prompt construction for a second-layer LLM analysis that is not actually performed locally. This mismatch can mislead users into overtrusting results, especially for security decisions, and can cause unsafe handling of adversarial skill content if operators assume deeper analysis occurred when it did not.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The code labels these adjustments as metadata bonuses, but it adds positive breakdown entries while also adding those same positive values to a variable named total_deduction, which is then added to the base score. This inverts the intended accounting model and can systematically inflate reputation scores, causing risky skills to be rated safer than they should be and undermining the scanner’s trust decisions.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The CLI claims to perform semantic analysis for prompt injection and hidden instructions, but in practice it only builds a prompt and then substitutes a default Layer 2 result. This creates a false sense of security: malicious skills can evade detection while users and downstream tooling believe a deeper security scan actually occurred.

Intent-Code Divergence

High

Confidence: 96% confidence
Finding: The module docstring states that the scanner orchestrates Layer 2 semantic analysis, but the implementation does not actually run that analysis and instead returns a default result. This documentation/behavior mismatch is security-relevant because operators may rely on the advertised protection and approve unsafe skills based on incomplete scanning.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The fallback returned by get_default_result() labels the outcome as "safe" even though no semantic analysis occurred, which can cause downstream systems or users to treat an unanalyzed skill as trusted. In a security scanner, fail-open behavior like this undermines detection and can let malicious or risky skills bypass review when the LLM step is skipped, fails, or is unavailable.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: SKILL.md:42