Skills Audit

• Outcome: Review
• Latest audit: Jul 9, 2026 · 8:08 PM UTC
• Version: 5.9.2

Overview

This skill is a real audit and skill-maintenance tool, but it should go to Review because its installer and maintenance workflows can make broad local changes without enough guardrails.

Install only if you are comfortable with a skill that scans local projects and installed skills, reads some profile/memory/config files, writes audit caches and snapshots, and can recommend or execute skill maintenance actions. Avoid the pipe-to-shell install commands; review or clone the installer first, and do not let a downstream Skills Manager auto-execute actions without confirming exact paths, packages, and repositories.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (23)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill declares tool requirements and operational behavior that clearly imply file reading and shell-capable actions, including git usage, installation attempts, rollback, and config generation, but it does not declare permissions explicitly. This creates a transparency and consent gap: users may invoke what appears to be an audit/reporting skill while it can perform environment changes or shell-backed operations.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence
• Finding: The skill is presented primarily as an audit and health-scoring tool, but the content also authorizes installation attempts, git-based update/rollback behavior, platform-specific directory detection, and configuration/file creation. This mismatch is dangerous because users may grant trust to a diagnostic skill without expecting repository mutation, environment changes, or broader system interaction.

Context-Inappropriate Capability

Medium

• Confidence: 81% confidence
• Finding: The README expands the skill's behavior beyond a purely local audit by documenting external network signal collection and agent reachability/access checks. Those features increase the data exposure and capability surface: a user invoking a local audit may unintentionally permit outbound lookups or broader environment probing that are not clearly bounded by the manifest description.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The README instructs users to pipe remote content directly into bash or PowerShell, which is a classic supply-chain and remote code execution risk. If the upstream repository, transport, or referenced script is compromised, users would execute arbitrary code immediately on their system.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The file defines a machine-readable action schema that a separate Skills Manager will read and execute, including destructive or state-changing operations like install, update, and archive. For a skill presented as an audit/reporting tool, this creates a dangerous control-plane expansion where audit output can directly drive privileged changes to the local skill environment, enabling prompt/output injection or unsafe recommendations to become executable actions.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The schema explicitly supports installation from external sources such as npm, GitHub, pip, and arbitrary URL-like origins, which expands the attack surface far beyond what an audit skill should need. If a malicious or manipulated audit result names an attacker-controlled package or repository, the downstream manager could fetch and install untrusted code, leading to supply-chain compromise.

Description-Behavior Mismatch

Medium

• Confidence: 72% confidence
• Finding: Instructing the skill to automatically generate, complete, and rewrite translated descriptions goes beyond passive auditing into active content modification. In a skill advertised as an auditor, this can cause unauthorized or misleading changes to metadata, mask original intent, and create integrity risks in CI/CD or automated maintenance workflows.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: A requirement to automatically correct the tool's own description indicates self-modifying behavior and weak separation between evaluation and mutation. Self-referential auto-correction can hide drift, silently rewrite audit targets, and reduce trustworthiness of the audit trail, especially in automated pipelines.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: Rollback triggers such as '回滚', '撤销', '恢复', 'rollback', and 'revert' are broad everyday terms that can appear in normal conversation and may unintentionally activate a destructive or state-changing operation. In this skill, rollback is tied to snapshot restoration and git-related undo behavior, so accidental triggering could revert files or skill state unexpectedly.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill states that missing tools may be automatically installed and missing files such as config.yaml or user-profile.md may be generated, but this behavior is not surfaced as a prominent warning in the skill description. Hidden installation and file creation are risky because they change the host environment and repository state under the banner of an audit task.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The installer deletes the entire existing install directory as part of error recovery for a failed `git pull --rebase`, without prompting the user, backing up data, or validating that the directory only contains expected repository contents. This creates a real integrity and availability risk because local modifications, untracked files, or a misresolved install path can be irreversibly removed.

Natural-Language Policy Violations

Medium

• Confidence: 76% confidence
• Finding: Forcing language behavior based on detected session language without user opt-in can process conversational context in ways users did not request and may alter outputs unexpectedly. In an auditing skill, this is more dangerous because deterministic, transparent output matters; implicit language switching can affect review accuracy, reproducibility, and handling of potentially sensitive session content.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The flow explicitly instructs the agent to read `memories/MEMORY.md` and `user-profile.md`, which can contain sensitive personal or project information, but it provides no user-facing notice, consent gate, or minimization guidance. In an auditing skill, this increases privacy risk because the skill may access data unrelated to the immediate task without making that access transparent to the user.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill explicitly requires project profiling data to be persisted to `{project}/.agents/project-profile.md` and refreshed automatically based on staleness, but it does not warn the user or require opt-in for this storage behavior. This can cause unintended retention of potentially sensitive repository metadata, especially in CI/CD or shared workspaces where generated files may be committed, cached, or exposed to other tooling.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The flow explicitly performs automatic full-directory backups of all editable skills and later deletes old snapshots via retention-based garbage collection, but it does not mention any user consent, visibility into what will be copied, or safeguards before deletion. In a skill-management context, this can expose sensitive local content and create unexpected data-retention or data-loss risks if users are unaware of snapshot creation and cleanup behavior.

Missing User Warnings

Low

• Confidence: 87% confidence
• Finding: The document explicitly instructs collecting audit feedback and storing it in `.data/stats.json` under `user_feedback`, but provides no notice about what is stored, retention, access controls, or whether the data may contain personal information. While the prompt appears simple, feedback can still reveal user behavior or opinions, so silent persistence creates a privacy and compliance risk.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The template hard-codes Chinese-language report output as the default presentation format without any user choice or locale negotiation. This can override user expectations or downstream system requirements, causing policy noncompliance, usability failures, or misleading output in multilingual environments, though it is not directly a code-execution or data-exfiltration risk.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The description-optimization section instructs rewriting content into Chinese by default, which imposes a language transformation without user opt-in. In an audit/reporting skill, this can silently alter original content, reduce fidelity, and create localization or compliance issues when source descriptions must remain unchanged or multilingual.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The document specifies rollback and snapshot-retention deletion behavior, but it does not clearly warn that confirming an undo will overwrite current files or that retention cleanup will permanently delete older snapshots. In a skill that supports rollback and CI/CD workflows, unclear destructive-operation messaging can cause accidental data loss or restoration of unintended state by legitimate users.

External Script Fetching

Low

• Category: Supply Chain

Content

#!/bin/bash
# skills-audit installer — curl -sL https://raw.githubusercontent.com/gtbwpkwjnb-alt/skills-audit-skill/main/install.sh | bash

set -e

• Confidence: 89% confidence
• Finding: The comment explicitly encourages a `curl ... | bash` installation flow, which causes users to download and immediately execute remote code without inspection, integrity verification, or pinning to a reviewed release. If the GitHub account, repository, branch, or transport path is compromised, arbitrary code will run on the user's machine.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

if [ -d "$INSTALL_DIR" ]; then
    echo "   Already installed. Updating..."
    cd "$INSTALL_DIR"
    git pull --rebase 2>/dev/null || { cd "$HOME" && rm -rf "$INSTALL_DIR" && git clone "$REPO_SSH" "$INSTALL_DIR" 2>/dev/null || git clone "$REPO_HTTPS" "$INSTALL_DIR"; }
else
    echo "   Cloning..."
    mkdir -p "$(dirname "$INSTALL_DIR")"

• Confidence: 94% confidence
• Finding: The script passes a recursively deleted path into `rm -rf` based on dynamically detected install locations, then immediately reclones into that path. Although quoted, this is still dangerous because a wrong or unexpected `INSTALL_DIR` value, symlink abuse, or platform misdetection could turn an update failure into destructive filesystem deletion.

Chaining Abuse

High

• Category: Tool Misuse

Content

if [ -d "$INSTALL_DIR" ]; then
    echo "   Already installed. Updating..."
    cd "$INSTALL_DIR"
    git pull --rebase 2>/dev/null || { cd "$HOME" && rm -rf "$INSTALL_DIR" && git clone "$REPO_SSH" "$INSTALL_DIR" 2>/dev/null || git clone "$REPO_HTTPS" "$INSTALL_DIR"; }
else
    echo "   Cloning..."
    mkdir -p "$(dirname "$INSTALL_DIR")"

• Confidence: 84% confidence
• Finding: The long `git pull ... || { ... rm -rf ... && git clone ... || git clone ...; }` chain mixes failure handling, destructive deletion, and multiple fallback network operations into one expression. This makes behavior harder to audit and reason about, increases the chance of unsafe recovery paths being triggered, and can mask partial failures during installation or update.

Chaining Abuse

High

• Category: Tool Misuse

Content

#!/bin/bash
# skills-audit installer — curl -sL https://raw.githubusercontent.com/gtbwpkwjnb-alt/skills-audit-skill/main/install.sh | bash

set -e

• Confidence: 91% confidence
• Finding: The documented `| bash` pattern is a command chain that directly feeds untrusted network content into a shell interpreter. In the context of an installer skill, this is especially dangerous because it normalizes remote code execution as the intended installation method and removes any opportunity for review or local policy controls.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.