Folder Icon

• Outcome: Review
• Latest audit: Jul 22, 2026 · 5:10 AM UTC
• Version: 0.1.0

Overview

This skill appears to do what it says, but it changes Windows folder icon files and attributes and downloads icon assets, so it should be run only on folders the user chooses.

Install only if you are comfortable with a skill that modifies selected Windows folders by writing icon files and desktop.ini, changing folder attributes, and downloading SVG icon data from external icon repositories. Prefer dry-run first, use trusted target directories, and consider local or pinned icon assets if network supply-chain risk matters.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill declares no permissions even though it clearly performs sensitive actions: reading and writing files, invoking shell/VBScript/attrib, accessing environment/runtime context, and downloading remote SVG content. Missing permission disclosure is dangerous because users and orchestrators cannot accurately assess or sandbox the skill, increasing the chance of unexpected filesystem changes or execution of platform commands.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence
• Finding: The documented behavior understates important capabilities: the skill fetches untrusted remote resources, can generate and run VBScript to alter file attributes, and supports WSL-to-Windows command bridging despite being described as merely a Windows folder icon utility. This mismatch is risky because operators may approve it for harmless local customization without realizing it performs network retrieval and command/script execution, which expands the attack surface and trust boundary.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The skill downloads SVG content at runtime from GitHub Raw via curl, but the manifest describes local icon generation/application and does not disclose network access. This creates a supply-chain and integrity risk: remote content can change, be unavailable, or be tampered with, causing unreviewed data to influence generated icons and execution flow.

Context-Inappropriate Capability

Medium

• Confidence: 82% confidence
• Finding: The script launches multiple external programs including npm, curl, wslpath, attrib.exe, and PowerShell. While some are functionally related to icon handling on Windows, invoking shell commands increases attack surface through PATH hijacking, unexpected binary behavior, environment manipulation, and hidden side effects not clearly disclosed by the skill description.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: Although the skill is presented as a local Windows folder-icon tool, it silently fetches SVG assets from an external CDN by default. This creates an unnecessary supply-chain and privacy risk: remote content can change unexpectedly, requests reveal usage metadata, and malicious or malformed SVGs may trigger vulnerabilities in downstream parsers/renderers.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The skill is presented as a local Windows folder-icon utility, but it silently retrieves SVG content from a remote GitHub URL at runtime. This creates a supply-chain and privacy risk: remote content can change unexpectedly, network use may surprise users, and icon generation depends on unpinned external data.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The code writes a temporary VBScript and executes it through cscript.exe to modify filesystem attributes, which expands the skill's execution surface beyond simple icon generation. Because the script content is built from folder paths and then executed by an interpreter, this introduces unnecessary code-execution machinery and increases risk if path contents are unusual or attacker-controlled.

Unvalidated Output Injection

High

• Category: Output Handling

Content

with open(vbs_path, "w") as f:
        f.write(vbs)

    subprocess.run(
        ["/mnt/c/Windows/System32/cscript.exe", "/nologo", "D:\\_set_attrs.vbs"],
        capture_output=True, text=True, encoding="gbk", errors="replace"
    )

• Confidence: 78% confidence
• Finding: subprocess.run( ["/mnt/c/Windows/System32/cscript.exe", "/nologo", "D:\\_set_attrs.vbs"], capture_output

VirusTotal

63/63 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/folder-icon.js:27