Security audit

Skill Creator

Security checks across malware telemetry and agentic risk

Overview

This appears to be a real skill-building toolkit, but it needs review because it can persistently change agent skills, run local/background tooling, and expose evaluation content through under-scoped workflows.

Review this skill before installing. Use it only if you are comfortable with it creating persistent skill files, running eval subprocesses, starting local review tools, and using Claude/Anthropic services. Avoid running it on secret-containing skills or eval sets, review generated ~/.skills changes before syncing, prefer static viewer output or an unused port, and do not preview untrusted XLSX outputs until the viewer sanitization issue is fixed.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: This file defines two materially different analyzer roles in the same skill: one that performs post-hoc winner/loser analysis and another that performs benchmark-wide pattern analysis. Without an explicit activation boundary or dispatcher, an agent may follow the wrong procedure, emit the wrong output schema, or blend both modes, causing integrity failures in downstream evaluation pipelines.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The skill explicitly instructs authors to make skill descriptions 'a little bit pushy' to counter undertriggering, which encourages overly broad activation criteria. In a system that can write files, run scripts, and manage skill distribution, collision-prone triggering can cause this skill to activate in contexts the user did not intend, leading to unnecessary filesystem changes, subprocess execution, or workflow takeover.

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: The skill directs the agent to generate files in ~/.skills/ and then tells the user to sync/distribute them, but it does not require explicit user confirmation or a warning before writing to a persistent location. Because ~/.skills/ is a durable and operational directory, unintended writes here can install or alter agent behavior beyond the current task and affect future sessions or other agents.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: These instructions launch background processes, generate review artifacts, and may open a browser or local server using nohup without a clear notice to the user. Silent local execution increases privacy and operational risk because data from prompts, outputs, and benchmarks may be written to disk or exposed through a local review interface longer than the user expects.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The description-optimization workflow runs a background subprocess loop that evaluates prompts repeatedly and uses local resources, but the skill does not require upfront disclosure of execution time, model/API usage, or data handling. This can surprise users with prolonged execution, additional cost, and persistent artifacts containing realistic prompt data.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The skill's overall scope is ambiguous because it combines two distinct analyzer workflows with different goals, inputs, and outputs in one markdown document. In agent systems, this kind of prompt ambiguity is a real security/reliability risk: an attacker or malformed caller can exploit the mixed instructions to induce misrouting, suppress expected analysis, or produce outputs incompatible with consuming components.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The script automatically terminates any process listening on the requested port before starting its own server, with no confirmation and no ownership check. In a shared workstation or developer environment, this can disrupt unrelated local services and cause denial of service or data loss if the killed process was performing important work.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: Spreadsheet content is converted to HTML with XLSX.utils.sheet_to_html(...) and then inserted via wrapper.innerHTML, which can render attacker-controlled cell content as active HTML. If an untrusted XLSX contains markup or script-capable content, this can lead to DOM XSS in the reviewer's browser, exposing feedback, embedded data, and any accessible session context; this viewer handles untrusted eval outputs, which makes the risk materially higher.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The code sends full prompts containing skill content, evaluation results, prior attempt history, and requests extended model thinking from the Anthropic API, then stores both the returned thinking and prompt/response transcript to disk when logging is enabled. If the skill content, eval data, or model reasoning contains secrets, proprietary prompts, or sensitive operational context, this creates an unnecessary data exposure path to both a third-party service and local log files.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: This code writes iterative evaluation history, including per-query results and descriptions, into an HTML file that may be stored in a temp location or user-specified path. In this workflow, the report contains train/test queries and results that can expose sensitive eval-set contents or prompt data to other local users, browser history, sync tooling, or screen-sharing contexts without any warning or consent step.

Missing User Warnings

Low

Confidence: 91% confidence
Finding: The script automatically opens the generated report in the user's default browser as soon as reporting is enabled, without prompting or clearly disclosing that local evaluation content will be displayed. This increases exposure risk because sensitive data may be surfaced to browser extensions, synced sessions, shoulder-surfing, or shared desktops, even if the user only intended to run a local optimization loop.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.