Security audit

verifiable-data

Security checks across malware telemetry and agentic risk

Overview

This skill performs a coherent Cryptowerk proof workflow by hashing user-selected files, contacting Cryptowerk APIs, and storing local proof metadata.

Install only if you are comfortable with Cryptowerk receiving hashes of files you choose to register or verify. Keep cwconfig.json and .cwseal files out of public repositories, shared folders, and automated sync locations, and avoid using this on highly sensitive files where even a stable hash or proof timestamp would reveal too much.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill advertises and documents Python scripts that read local files, write sidecar artifacts, and interact with an external service, but the manifest does not declare corresponding permissions or otherwise surface those capabilities explicitly. This creates a transparency and policy-enforcement gap: users and host systems may underestimate the skill's access to local data and network endpoints, increasing the risk of unintended file disclosure or credential-related misuse.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The description says the skill 'automatically acquires service credentials' but does not provide a prominent warning about outbound authentication, token storage, or when network access occurs. Automatic credential acquisition is sensitive behavior because it can surprise users, expand trust boundaries, and lead to mishandling of tokens or unintended external communication if not clearly disclosed and controlled.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: This code makes outbound HTTPS requests to Cryptowerk, automatically acquires service credentials via a hardcoded bootstrap key, and persists returned credentials to a local config file without any user-facing disclosure or consent mechanism. In an agent skill context, silent network access and credential materialization can surprise users, expand the trust boundary, and create risk if the local config file is exposed or reused unexpectedly.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The helper downloads arbitrary remote content from a caller-supplied host and URL and writes it directly to a caller-supplied local path, with no validation, integrity check, size limit, allowlist, or user disclosure. In an agent environment, this can enable unreviewed file writes, overwriting local artifacts, or persistence of attacker-controlled content if upstream inputs are influenced by untrusted data.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The script transmits a deterministic SHA-256 hash of the user-selected file to an external service as part of document registration, but provides no explicit user disclosure or consent prompt at the point of transfer. Even if the raw file contents are not uploaded, hashes can still act as stable identifiers, enabling correlation, existence checks for known files, or leakage of sensitive workflow metadata to the remote provider.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.