Security audit

AKF — Trust Metadata for Agent Files

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed file-metadata tool, but users should remember that its stamps can remain inside shared files.

Install this only if you want agents to add AKF trust metadata to files they create or modify. Avoid putting secrets, personal data, or sensitive internal reasoning in evidence strings or labels, and inspect or strip metadata before sharing files externally.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill instructs users to stamp every created or modified file, but it does not clearly warn that stamping alters file contents by embedding metadata. In this skill’s context, that metadata can include agent identity, confidence, evidence, labels, and provenance, which can unintentionally disclose internal workflow details or sensitive context when files are shared externally.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The examples encourage embedding classification labels, evidence, and agent metadata directly into files without any privacy or data-handling warning. Because the skill explicitly supports native embedding into DOCX, PDF, images, and code, users may persist confidential business context, review status, or operational details into artifacts that are later published, emailed, or committed to repositories.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.