huly

• Outcome: Pass
• Latest audit: Aug 27, 2026 · 2:58 AM UTC
• Version: 1.0.6

Overview

This skill can change a Huly workspace, but that capability is clearly part of its purpose and the risky actions are disclosed with confirmation guidance.

Install this only if you trust the third-party huly CLI and want an agent to operate your Huly workspace. Use a least-privilege service account or short-lived token where possible, confirm destructive actions and public/notification-sending actions explicitly, and clarify workspace, recipient, and timezone before writes.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This recipe documents a destructive raw RPC path that can remove recurring instances while explicitly noting it is irreversible and bypasses CLI confirmation, yet it does not embed a strong, immediate warning or guarded procedure adjacent to the command sequence itself. In an agent skill context, documentation like this can be operationalized directly by an assistant, increasing the chance of accidental data loss from a misunderstood or insufficiently confirmed request.

Natural-Language Policy Violations

Medium

• Confidence: 77% confidence
• Finding: The guidance tells operators to accept the default UTC behavior when no raw override is used, which can cause events to be created at unintended local times if user timezone intent is not explicitly captured. In a scheduling skill, this is materially risky because the primary effect is persistent calendar modification, so a silent timezone assumption can lead to missed meetings, incorrect invites, or automation acting on the wrong schedule.

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: The documentation explicitly describes that sending messages and using @mentions will trigger inbox notifications to other users, but it does not frame this as an agent safety concern or instruct the agent to obtain user confirmation before causing those side effects. In an agent skill, this can lead to unintended outreach, alert spam, or privacy-sensitive disclosures through automated mentions, especially because message sends are persistent workspace actions.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documented `huly user find <email>` behavior explicitly searches the entire account pod before checking the current workspace, which can reveal whether an email exists outside the active workspace boundary. In a multi-tenant admin/automation skill, omitting a privacy warning or usage restriction can encourage cross-workspace identity enumeration and disclosure of user presence that the operator may not expect.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

> **This file is for advanced use only.** The high-level CLI surface (`huly issue …`, `huly document …`, `huly calendar …`, …) handles authentication, ref resolution, cascade awareness, type checking, and error mapping. Two commands bypass all of that and talk to the server directly:
>
> - **`huly api <METHOD> <path>`** — raw HTTP passthrough. Any path on the configured workspace API URL, any supported method (`GET | POST | PUT | PATCH | DELETE`), any header (except `Authorization`, which the CLI always overwrites with the resolved token — see below). No validation, no schema check, no ref resolution.
> - **`huly ws <method> [params]`** — raw WebSocket RPC. Calls SDK methods directly with whatever payload you hand it. No validation, no schema check, no confirmation, no cascade awareness.
>
> Treat these like raw SQL: powerful, untyped, unguarded, and irreversible. Most workflows do not need them — prefer the high-level commands. If you find yourself reaching for these often for a pattern the CLI should expose, that's a missing-feature signal: file an issue.

• Confidence: 92% confidence
• Finding: This documentation explicitly exposes raw HTTP and WebSocket primitives that bypass the CLI’s normal validation, schema checks, confirmation flow, and safety guardrails. In an agent skill context, that creates a real capability-escalation risk: if the agent is induced to use these commands, it can perform arbitrary read/write operations against the Huly server, including irreversible changes the high-level interface intentionally prevents or constrains.

VirusTotal

63/63 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.