Security audit

dodaf-skill

Security checks across malware telemetry and agentic risk

Overview

This DoDAF skill is not malware, but it needs review because it may use sensitive defense-planning details in external research and overstates how strong its validation checks are.

Install only if you can control what information is shared externally. Do not provide classified, export-controlled, sensitive mission, stakeholder, system, or capability details unless web search is disabled or the query context is sanitized. Treat generated verification results as heuristic checks that require expert review, and run the skill in a dedicated project directory so generated artifacts are easy to manage.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill explicitly describes capabilities equivalent to file read, file write, and shell execution through artifact generation and sample `pandoc`/diagram export commands, yet no permissions are declared. That mismatch can cause the agent to perform powerful local actions without transparent authorization boundaries, increasing the risk of unintended file modification, data exposure, or command execution.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The script advertises comprehensive completeness and consistency verification, but most checks only test for file names, simple content keywords, and presence of references rather than validating actual DoDAF model semantics. In a defense architecture workflow, this can create false assurance that a model is complete or internally consistent, causing downstream decisions, reviews, or compliance reporting to rely on unverified artifacts.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The code claims cross-view consistency verification, but it only counts references and then unconditionally reports cross-reference consistency as OK without comparing entities, mappings, or dependencies between views. This is dangerous because users may trust the report to catch model contradictions when the check does not meaningfully validate consistency at all.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill says it will automatically search for defense doctrine, standards, and best practices when information is insufficient, but it does not warn users that queries may include sensitive defense architecture context. In this domain, even partial mission, stakeholder, environment, or capability details can be sensitive, so automatic external transmission materially increases confidentiality risk.

Missing User Warnings

Low

Confidence: 88% confidence
Finding: The skill produces many documents, diagrams, matrices, and consolidated reports in the workspace but does not clearly warn the user up front that it will create and persist these artifacts. For defense architecture work, silent persistence can leave sensitive design data on disk in multiple locations, broadening the exposure surface.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.