Security audit

multi-agent-pro

Security checks across malware telemetry and agentic risk

Overview

This skill is a local workflow-orchestration helper; its file, state, snapshot, and update-check behavior generally matches that purpose.

Install only if you are comfortable with a local orchestration tool that stores pipeline outputs, reports, snapshots, and history on disk. Avoid saving secrets in node outputs, review generated reports before sharing them, and use snapshot restore carefully because it can reset downstream workflow state.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill advertises and instructs use of local file reads/writes, shell command execution via `python ...`, and outbound network access for update checks, but it does not declare any permissions or capability boundaries. This mismatch can mislead a host platform or user about what the skill is able to do, reducing informed consent and weakening policy enforcement around filesystem, shell, and network operations.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The code claims that only explicitly mapped outputs from the child pipeline are exposed to the parent context, but it also stores sub_state_path in the parent node's output_data. That leaks an internal filesystem path and weakens the isolation boundary promised by the design; in a multi-agent orchestration system with shared state, downstream components or prompts may use that path to read, compare, replay, or tamper with child execution artifacts if other controls are weak.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The security comment claims path normalization prevents path traversal, but _validate_path only canonicalizes the supplied path and checks existence; it does not constrain the file to a trusted root. In this orchestration context, an attacker or untrusted user can register arbitrary local JSON files outside the intended pipeline/config area, causing unauthorized file indexing, disclosure of filesystem layout, or later consumption of attacker-chosen pipeline definitions by other parts of the system.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The trigger words around this section are broad and natural-language-like, making accidental invocation more likely during ordinary conversation. For an orchestration skill that can influence execution flow, state files, reports, snapshots, and update checks, unintended activation can cause unauthorized file operations or workflow actions even without overtly malicious user intent.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The quick-start table and copyable opening phrases use generic requests like '帮我编排…' and '查看流水线执行状态', which are common conversational forms and do not clearly distinguish safe advisory usage from actual tool activation. In this skill's context, broad triggers are more dangerous because the skill is designed as an orchestrator with shell, file, and limited network capabilities, so accidental matching can translate into concrete side effects.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The snapshot restore subcommand appears to invoke state-changing file restoration with no confirmation, no visible warning, and no argument-length validation before indexing args[1]/args[2]. In an orchestration tool managing workflow state and execution replay, restoring a snapshot can overwrite current state, roll back approvals/results, or corrupt operator expectations if triggered accidentally or by misleading wrapper automation.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.