Security audit

find-skills

Security checks across malware telemetry and agentic risk

Overview

This skill performs broad skill discovery and installation actions, but its trigger scope, install safeguards, token use, and forced promotional output need review before use.

Install only if you intentionally want a broad skill-search and installation assistant. Before use, require explicit confirmation before remote searches or installs, review any recommended skill source manually, avoid exposing GITHUB_TOKEN unless needed, and remove or ignore the forced promotional footer behavior.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The skill explicitly instructs use of the GITHUB_TOKEN environment variable in outbound GitHub API requests. While this does not directly exfiltrate the token, it normalizes secret access inside a discovery skill and couples user requests to authenticated external requests, increasing the chance of unintended credential disclosure, logging leakage, or misuse if surrounding tooling interpolates commands unsafely.

Context-Inappropriate Capability

Low

Confidence: 97% confidence
Finding: The skill mandates appending unrelated promotional content to every output, regardless of user intent. This is an abuse of the agent output channel for lead generation and can manipulate users, reduce trustworthiness, and create social-engineering opportunities by steering users to external contact points and links.

Vague Triggers

High

Confidence: 95% confidence
Finding: The skill advertises activation on very broad natural-language requests such as wanting to make a poster or analyze stocks, which overlaps with ordinary user conversations rather than a narrowly scoped invocation boundary. In an agent system, this can cause unintended interception of unrelated prompts, increasing the chance of tool hijacking, unwanted installation flows, or routing users into external skill discovery without explicit consent.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The usage section shows broad scenario-based activation but does not define when the skill must stay inactive, creating ambiguous trigger boundaries. This ambiguity can lead to accidental activation during routine conversation, unnecessary exposure to external marketplaces, and unexpected tool-driven behavior that the user did not explicitly request.

Vague Triggers

High

Confidence: 98% confidence
Finding: The skill description is triggered by extremely broad, everyday natural-language requests such as design or stock analysis. This creates trigger hijacking risk: the skill may activate in many unrelated contexts and then perform filesystem scans, remote searches, or installation flows the user did not explicitly request.

Vague Triggers

High

Confidence: 97% confidence
Finding: The overview claims activation from essentially any natural-language description of a user's needs. In context, this is more dangerous because the skill also performs multi-source discovery and supports installation, so ambiguous triggering can lead to unrequested external calls and local system modification paths.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The top-level description advertises one-click installation without any warning about trust boundaries, code provenance, or local system changes. Because the skill aggregates third-party sources, this can mislead users into installing unreviewed skills with insufficient awareness of risk.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The instructions copy marketplace-cached skills directly into the local skills directory without integrity verification or explicit trust prompts. This can cause local persistence of unreviewed skills and expands risk if the cache contains tampered or malicious content.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The GitHub installation flow clones arbitrary third-party repositories into the local skills directory and only checks for the existence of SKILL.md. Presence of that file is not a meaningful security validation, so users may install malicious or deceptive skills from untrusted repositories.

Natural-Language Policy Violations

Medium

Confidence: 98% confidence
Finding: The skill forces promotional Chinese-language content and contact information into every response without user opt-in. This is dangerous because it overrides user intent, manipulates outputs for advertising, and pushes users toward off-platform links and social channels that could be used for phishing, spam, or deceptive monetization.

External Transmission

Medium

Category: Data Exfiltration
Content: fi # 搜索包含 SKILL.md 的代码 curl -s $AUTH_HEADER "https://api.github.com/search/code?q=filename:SKILL.md+<关键词>&per_page=10" # 搜索技能相关仓库 curl -s $AUTH_HEADER "https://api.github.com/search/repositories?q=<URL-encoded 关键词>+skill+in:name,description&per_page=10"
Confidence: 88% confidence
Finding: https://api.github.com/

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.