harness-skill-generator

• Outcome: Review
• Latest audit: Aug 18, 2026 · 11:01 AM UTC
• Version: 0.1.0

Overview

This skill is a coherent skill generator, but it includes risky guidance for restricted-platform automation and shared agent-environment installation.

Review before installing. Use this only if you are comfortable with a Chinese-language meta-skill that can create and install other skills into a shared agent environment. Remove or rewrite the restricted-platform automation guidance so generated skills prefer authorized APIs and stop when automation is prohibited. Confirm the install path, `AGENTS.md` changes, `MEMORY.md` entries, and rollback steps before allowing installation.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The skill explicitly recommends reversing solution priorities for platforms with anti-bot or anti-AI restrictions and elevates human-behavior simulation/RPA as the preferred approach. In a generic skill-generator context, this guidance can facilitate evasion of platform safeguards and enable creation of automation intended to bypass access controls or enforcement mechanisms.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The workflow goes beyond generating files and directs installation into a shared skills directory plus updates to AGENTS.md and MEMORY.md, which can modify the local agent environment and persist behavior changes beyond the current task. Because these are shared/global locations, misuse could affect other agents or future sessions without a clear, scoped approval step.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The trigger phrases are broad enough to match common requests like creating a skill or workflow, increasing the chance of accidental invocation in unrelated contexts. Overbroad activation can route users into a powerful scaffold/installation workflow they did not intend, raising the risk of inappropriate file generation or environment modification.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The Phase 0 activation logic relies on ambiguous natural-language conditions and recommendation heuristics, but lacks strong disambiguation boundaries. This can cause the skill to engage for loosely related automation requests, amplifying the chance of mis-scoped assistance and unintended downstream actions.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger table includes broad requests such as building an automation flow, which may capture everyday task requests not meant for this skill. In combination with later scaffold and installation steps, this broad routing expands the operational footprint of an otherwise niche skill.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The skill instructs installation into a shared agent skills directory without an explicit warning that this changes the local agent environment and may affect all agents. Even if the modification is intended, lack of informed consent and scoping creates a safety and usability risk.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The manifest advertises generic trigger phrases such as '创建 Skill', '新建 Skill', and '构建 Skill', which are broad enough to match ordinary user requests rather than an explicit invocation of this specific skill. In a meta-skill that helps generate other skills, accidental activation is more dangerous because it can redirect conversations into code/config generation workflows the user did not clearly request.

Natural-Language Policy Violations

Medium

• Confidence: 74% confidence
• Finding: The description is written entirely in Chinese and does not indicate any user-language negotiation or justified locale restriction, which can cause the skill to steer interaction into a language the user did not choose. While this is not a classic code-execution issue, it can degrade transparency and consent, especially for a meta-skill whose outputs may be copied into downstream engineering artifacts without the user fully understanding them.

Ssd 4

Medium

• Confidence: 95% confidence
• Finding: Normalizing human-like simulation as the preferred method for restricted platforms frames anti-bot/anti-AI defenses as obstacles to be worked around rather than boundaries to respect. This increases the likelihood that downstream skills generated from this template will incorporate evasive automation patterns with compliance and abuse risk.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.