Back to skill

Security audit

Skill Search Optimizer

Security checks across malware telemetry and agentic risk

Overview

This is a search-optimization guide for skills with disclosed, user-run registry commands and no hidden execution.

Install is reasonable if you want help improving a skill’s registry search ranking. Before running the examples, remember that npx molthub@latest runs the current published CLI, and publish or install commands can change registry state or add other skills, so review the target skill and version before executing them.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Self-Modification

High
Category
Rogue Agent
Content
npx molthub@latest search "secondary query"

# 3. If ranking is poor, update the description
# Edit SKILL.md frontmatter

# 4. Publish updated version
npx molthub@latest publish ./skills/my-skill \
Confidence
90% confidence
Finding
Edit SKILL

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.