Security audit

workled

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly a coherent workled device controller, but it documents password-typing and computer-unlock macros over a plain HTTP device connection without adequate safety warnings.

Review carefully before installing. Use it only with a trusted workled device on a trusted local network, prefer installing only the client you actually use, and avoid configuring password or unlock macros unless you fully understand that the device can type credentials into the active computer session.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill description exposes operational capabilities that go beyond a pure documentation-only MCP skill, including environment and network-related behavior, but it does not declare corresponding permissions. That creates a transparency and trust problem: users and hosts may enable the skill without understanding it can inspect configuration sources or perform reachability checks, increasing the risk of unintended data exposure or policy bypass.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill’s stated purpose is limited to LED state updates and macro configuration, but the analyzed behavior indicates broader functionality such as scanning client config files, discovering MCP URLs from environment/config locations, and probing network reachability. This mismatch is dangerous because it can hide sensitive file inspection and network activity behind an innocuous peripheral-control description, undermining informed consent and making lateral discovery of local infrastructure easier.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The documentation instructs users to configure a remote MCP endpoint over plain HTTP on the local network with no warning about lack of transport security or peer authentication. That means agent prompts, tool traffic, and device-control commands could be observed or modified by an attacker on the same network, which is especially relevant because this skill installs automatic hooks that will send state changes continuously.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The documentation explicitly defines a `password` macro primitive that types stored secrets and describes its use without any warning, consent boundary, or misuse guidance. In the context of a device that can emulate keyboard input, this materially enables credential injection and unattended login workflows, which can facilitate unauthorized access if a device or configuration is misused.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The examples provide ready-to-use Windows and macOS unlock sequences that combine screen-lock/login interaction with stored password entry, effectively documenting an automated workstation access pattern. In a HID macro skill, this is more dangerous than generic macro syntax because it lowers the barrier to creating account-unlock automation that could be abused on lost, shared, or unattended machines.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.