Security audit

winskill

Security checks across malware telemetry and agentic risk

Overview

This Windows server administration skill contains useful, disclosed admin workflows, but it also includes broad remote command execution, credential storage, scheduled tasks, and destructive repair steps that conflict with its read-only/offline safety claims.

Install only if you intentionally want a powerful Windows Server administration skill and will review every command before execution. Do not use it in restricted/offline environments as written, and avoid the remote-management module unless you are comfortable with stored credentials and arbitrary command execution across servers.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (12)

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: The skill repeatedly claims "只读分析/绝不误删文件", but this section performs direct deletion with Remove-Item and also empties recycle-bin contents by deleting paths, which is not read-only and can be irreversible. That mismatch is dangerous because users may consent based on false safety expectations and trigger destructive cleanup on production systems.

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: This module is described as "只读分析", but it creates scheduled tasks, creates directories, and writes baseline CSV/tag files to disk. The discrepancy undermines operator trust and can introduce persistence-like behavior on managed servers without a clearly elevated warning.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The compliance section says it is read-only and does not change system configuration, yet it writes Markdown reports to disk. While lower risk than service or file deletion, it still violates the advertised no-write behavior and may expose sensitive inventory/compliance data in predictable locations.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The skill-level description promises fully offline and read-only behavior, but multiple modules make outbound network connections, probe remote hosts, and support remote administration. This broad mismatch can cause unexpected data egress, network scanning, or remote interaction in environments that rely on the stated offline guarantee.

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The unsupported-scenarios section says the skill does not start/stop/modify services, but other modules explicitly call Stop-Service, Start-Service, and service-start remediation flows. Such contradictions create unsafe operator assumptions and can lead to service interruption on critical systems.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The document says it does not modify network IP/DNS configuration, yet the repair workflow resets the IP stack, flushes DNS, resets Winsock, and disables/enables adapters. Even if not editing static IP values directly, these are impactful network state changes that can disrupt connectivity.

Context-Inappropriate Capability

Critical

Confidence: 100% confidence
Finding: This section enables batch remote command execution across registered servers and runs user-supplied input through Invoke-Expression inside Invoke-Command. That creates a powerful arbitrary code execution primitive on multiple remote hosts, greatly exceeding the minimum permissions expected from a diagnostic skill and magnifying mistakes or prompt injection into fleet-wide compromise.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The module frames credential handling as simple server registration, but it collects credentials and stores them via cmdkey for later remote use. This weakens the perceived sensitivity of the action and may encourage unsafe credential caching on admin workstations.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The quick-start examples map ordinary conversational phrases directly to operational actions, increasing the chance that an assistant auto-activates the skill unintentionally. In a skill that includes deletion, service control, and remote-management features, overly broad triggers raise the risk of accidental execution or unsafe escalation from casual chat.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The repair module is activated by vague troubleshooting language like "帮我修 DNS" or "网络不正常", which overlaps with normal support conversation. Because these workflows perform state changes, broad triggers make accidental invocation more dangerous than in a purely diagnostic skill.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: Mapping the remote-management module to a generic phrase like "远程服务器" is too broad for a capability that can register hosts, store credentials, and execute commands remotely. Generic activation lowers the barrier to triggering high-impact features unintentionally or through ambiguous user requests.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The top-level description advertises fully offline operation, but the skill contains multiple remote DNS/SSL/network probes, Docker/K8s connectivity checks, and WinRM-based remote management. Without a prominent warning, users may deploy it in restricted environments under false assumptions about network behavior.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.