Security audit

Genor Orchestrator Skill

Security checks across malware telemetry and agentic risk

Overview

This is a real project-orchestration skill, but its dashboard and logging features expose and persist local project/model data too broadly for automatic approval.

Install only if you are comfortable with a local orchestration tool that stores project/session context on disk and can run a dashboard or scheduled jobs. Do not expose the dashboard beyond localhost unless you add authentication and restrict CORS; review or disable session/context logging for sensitive projects; and run onboarding, cron, PM2, and provider probes only after confirming the exact files, endpoints, and scheduled commands involved.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The server exposes unauthenticated POST endpoints that create and modify project documents, project configuration, and model records, and the DELETE handlers similarly remove persisted data without any access control. Because it binds to 0.0.0.0 and also enables permissive CORS, any reachable client or website can drive these state-changing operations against local orchestration data.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The GET API returns full project state, document contents, session logs, pricing history, config, and even the local data directory path to any unauthenticated caller. With Access-Control-Allow-Origin set to '*', this data can be exfiltrated cross-origin from a victim's browser if the dashboard is reachable, exposing potentially sensitive project context and operational metadata.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The onboarding instructions tell the agent to run shell scripts and filesystem discovery commands against arbitrary project paths, which grants broad codebase modification and enumeration capability beyond passive orchestration. This is dangerous because it can create files, alter repositories, and inspect local content without an explicit user confirmation step or tight path/scope restrictions.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: Installing a nightly cron job creates persistence on the host and changes system behavior beyond the immediate onboarding session. Even if framed as a convenience feature, adding scheduled tasks without strong consent and clear disclosure can normalize stealthy persistence and may expose pricing, usage, or environment data over time.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The script makes outbound HTTP requests to third-party pricing pages even though the skill is described as an orchestration utility, not a network price-monitoring tool. In an agent context, this expands the trust boundary, can leak environment-derived usage patterns or metadata through network access, and introduces supply-chain and SSRF-like risk if URLs are later made configurable or if this script is invoked automatically.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The script actively probes external services, localhost endpoints, installed CLIs, and GPU presence during onboarding, which collects environmental intelligence beyond the minimum needed to initialize a dashboard/orchestrator. Even though the actions are not overtly destructive, this kind of host and network reconnaissance can expose sensitive information about the user's tooling and infrastructure and normalizes broader discovery that could be repurposed by a malicious or compromised skill.

Intent-Code Divergence

Low

Confidence: 79% confidence
Finding: The comments frame the script as a limited helper for probing and file writes, but the emitted follow-on instructions direct the LLM to perform broader actions such as project directory discovery and cron setup. This mismatch is dangerous because it understates the operational scope of onboarding and may cause users or reviewers to consent to or trust behavior they would otherwise scrutinize.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill states that session history, recovery documents, decisions, and project context are persisted on disk across session wipes, but it does not provide a prominent privacy warning or data-retention controls. This can lead to accidental storage of sensitive prompts, code context, project metadata, and architectural decisions in locations users may not expect.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill describes a standalone HTTP dashboard with configuration mutation endpoints and PM2-managed background execution, but it does not warn about local service exposure, authentication, or integrity risks. A locally exposed admin API can be abused by other local processes or, depending on bind settings, remote hosts to alter routing, models, or persisted configuration.

Missing User Warnings

Low

Confidence: 95% confidence
Finding: The documentation instructs execution of initialization and logging scripts that create or modify files, but it does not require any user-facing warning or consent before those side effects occur. In practice, this can surprise users with repository changes, added planning artifacts, or modified project metadata, increasing the risk of unintended local changes.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The instruction to 'probe every provider you can reach' is overly broad and weakly bounded, encouraging expansive discovery across local services, CLIs, and potentially network-accessible endpoints. This kind of open-ended probing can lead to unintended service interaction, environmental enumeration, and access attempts that exceed user expectations.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The guide directs the agent to inspect local environment state, query localhost services, check CLIs, and probe GPU details without clearly warning the user that onboarding will access local services and system information. Lack of up-front disclosure undermines informed consent and can surprise users with network/service interactions and host inspection.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The onboarding flow instructs writing catalog data, summaries, and session logs, but does not clearly warn that local files will be created or modified. Silent or poorly disclosed file writes can alter project state, leave sensitive metadata on disk, and reduce user control over what is stored.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: This script persistently records full task descriptions, notes, and optional context into markdown and JSON files, and it can additionally ingest arbitrary context from a file and store it verbatim. In an orchestration skill that manages projects and sessions across runs, that behavior creates a real risk of unintentionally storing secrets, proprietary code, credentials, or sensitive operational context without any warning, redaction, minimization, or opt-in control.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.