Autonomous Cascade

Security checks across malware telemetry and agentic risk

Overview

This instruction-only skill is transparent, but it gives an agent broad autonomous action authority and includes an under-scoped process-kill example that could disrupt unrelated work.

Install only if you want an agent to run bounded multi-step workflows autonomously. Before using it, set explicit allowed tools, paths, hosts, budgets, and stop conditions, and require confirmation before writes, network changes, restarts, or process termination. Replace the blanket node.exe kill step with PID- or service-specific handling.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill explicitly recommends disruptive actions such as `taskkill /F /IM node.exe` and restarting a gateway as part of an autonomous loop, but it does not require an upfront user warning, confirmation, or strong scoping to the intended process. In an agent setting, this can terminate unrelated Node.js workloads or cause service interruption, making the operational guidance unsafe even if the intent is troubleshooting.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal