ia-agent-native-architecture

• Outcome: Review
• Latest audit: Aug 4, 2026 · 2:04 AM UTC
• Version: 4.3.3

Overview

This documentation-only skill is not directly executable, but it should be reviewed because it promotes broad agent file/API access, self-modification, and persistent user context with uneven safeguards.

Review before installing. Use this skill only as high-autonomy architecture guidance, not as a safe-by-default implementation template. If you apply its patterns, add explicit workspace allowlists, secret exclusions, user consent for sensitive data, confirmation for writes/publishes/deploys, audit logs, rollback, retention limits, and human review for code or prompt self-modification.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (27)

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The document explicitly recommends removing path-based read restrictions so a primitive read_file tool can access arbitrary files. In an agent architecture context, this is dangerous because it expands the agent's natural-language reachable data surface to secrets, credentials, source code, and user files without a compensating control described at the point of use.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The skill calls path restrictions an 'artificial limit' to remove, but later says security validation should remain in code. That contradiction is risky because implementers may remove access controls under the banner of prompt-native design, weakening security boundaries while believing they are following best practice.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The manual testing section includes broad prompts such as "Delete everything", "Help me with my books", and "Continue where I left off" without pairing them with explicit safety constraints, authorization checks, or negative test expectations beyond a brief confirmation note. In an agent-native architecture skill, these examples can normalize ambiguous or over-broad destructive instructions and encourage implementers to optimize for compliance rather than safe refusal, confirmation, or scoping.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This pattern explicitly encourages an agent to update public website content and then commit/push changes that trigger deployment, but it does not pair that capability with a clear approval or user-confirmation requirement for public-facing modifications. In an agent-native architecture, this can lead to unintended publication of incorrect, sensitive, manipulated, or reputation-damaging content if the agent misinterprets input or is prompt-injected.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The ChatAgent configuration includes a tool that can publish directly to a feed, but the documentation does not warn that the action is externally visible or recommend a confirmation boundary. This is dangerous because conversational agents are especially exposed to ambiguous user requests, hallucinations, and indirect prompt injection, which can cause unauthorized or misleading content to be published immediately.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The document recommends injecting user profile, library contents, and recent activity directly into the system prompt, which can expose sensitive user data to the model beyond what is minimally required for the task. In an agent-native architecture skill, this guidance can normalize broad prompt-side data disclosure without consent, minimization, or visibility controls, increasing privacy leakage risk through model outputs, logs, or downstream tool use.

Missing User Warnings

Medium

• Confidence: 80% confidence
• Finding: The examples map user requests to web search and file-writing capabilities without corresponding safety checks, confirmation boundaries, or warnings about external access and persistent side effects. In practice, this can lead developers to build agents that perform networked research or write files automatically from ambiguous requests, increasing the chance of unwanted data modification or exfiltration.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The document explicitly recommends storing persistent user preferences, interests, recent activity, and learned guidelines in a session-spanning `context.md` file, but it does not pair that pattern with privacy boundaries, retention limits, consent, or minimization guidance. In an agent-architecture skill, this omission can lead implementers to persist sensitive behavioral data in readable files indefinitely, increasing exposure through local access, sync providers, backups, logs, and accidental sharing.

Missing User Warnings

Low

• Confidence: 81% confidence
• Finding: The example workflow normalizes downloading content, saving research artifacts, and updating `context.md` without warning that these actions create persistent local copies and derived user-profile data. While less severe than the main pattern section, examples strongly influence implementation and may cause developers to overlook notice, consent, and lifecycle controls for stored content.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This guidance explicitly recommends exposing powerful primitives like file writes, bash, storage, and HTTP fetch early in agent design, while emphasizing that the default should remain open access. In an agent-native architecture skill, that materially increases the chance of unsafe file modification, command execution, data exfiltration, or lateral movement if prompts are misused, jailbroken, or connected to sensitive environments.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The examples normalize direct write and publish actions as ordinary agent behavior without emphasizing side effects, approvals, or safeguards. In this skill's context, where agents are positioned as primary actors and prompts are expected to make decisions, that can lead implementers to let agents modify user data or publish externally without adequate validation, authorization, or audit controls.

Natural-Language Policy Violations

Medium

• Confidence: 87% confidence
• Finding: The document explicitly promotes full action parity between user and agent for sensitive external APIs, including HealthKit characteristic data, and frames dynamic discovery plus generic access as the default pattern. In a security-sensitive design guide, that encourages over-broad capability exposure without emphasizing consent, least privilege, per-scope authorization, or policy gating, which can lead downstream implementers to grant agents unnecessary access to sensitive personal data.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The document recommends iCloud Documents as the default shared workspace for agent-native apps and emphasizes automatic sync, but it does not prominently warn that both user-authored and agent-generated workspace contents will be uploaded into the user's iCloud account and replicated across devices. In this skill context, that omission is meaningful because agent workspaces may contain prompts, logs, research artifacts, or other sensitive data that users may not expect to leave local storage.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The guidance explicitly tells the agent to create or move files using broad file tools and 'use your judgment' without any warning, confirmation requirement, or scope restriction around modifying user data. In an agent-native architecture context, this increases the chance of unintended destructive or privacy-impacting file operations because the agent is empowered to reorganize content autonomously until it declares completion.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The document promotes broad autonomous code changes, deploys, pulls, merges, and restarts while framing them as desirable capabilities, but it does not prominently warn about the integrity, supply-chain, and availability risks of letting an agent modify and redeploy itself. In this skill context, that omission is more dangerous because the material is architectural guidance likely to be implemented directly by developers, making unsafe defaults easy to reproduce at system level.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: These examples normalize agent access to read any project file and write prompts or code across the repository without a clear privacy or data-handling warning, even though project files commonly contain secrets, credentials, proprietary code, and personal data. In an agent-native architecture skill, this is especially risky because readers may copy the patterns and inadvertently give agents broad data access and prompt self-edit authority that can lead to data exfiltration or persistence of unsafe behavior.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The document promotes agent read/write tools over a shared workspace and includes example implementations that perform broad filesystem operations, but it does not pair that guidance with a clear user-facing warning or consent model about what data the agent may access or modify. In an agent-native architecture, this can lead developers to expose large portions of user content to the agent by default, increasing the risk of privacy violations, accidental destructive edits, or prompt-influenced tampering of user files.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The iCloud guidance emphasizes convenience and automatic sync, but it does not clearly warn that any files readable or writable by the agent may replicate across the user's devices and remain visible in Files.app. That omission can cause developers to store agent-generated summaries, chat artifacts, or sensitive user-derived data in synced locations without adequately informing users of the privacy and persistence implications.

Missing User Warnings

Medium

• Confidence: 73% confidence
• Finding: The example explicitly instructs an agent to sync content, commit, and push to trigger a deploy, but it does not pair those actions with authorization boundaries, confirmation requirements, or environment safeguards. In agentic settings, normalizing autonomous repository writes and deployment behavior without warnings can lead to unintended production changes, especially if readers reuse the example verbatim in real system prompts.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The skill advocates a natural-language file that accumulates user-specific knowledge across sessions, including interests, activity, and personalized rules, which creates a durable cross-session profile store. In the context of agent-native architecture guidance, this is more dangerous because it is presented as a reusable design pattern and may be adopted broadly without safeguards, enabling overcollection, secondary use, and leakage of sensitive personal context.

Ssd 3

High

• Confidence: 97% confidence
• Finding: The text directly instructs that a read_file tool should 'read anything,' which enables an agent to retrieve arbitrary local data through ordinary prompt requests. In agent-native systems, unrestricted reads are especially dangerous because the model can be socially engineered or prompt-injected into exfiltrating secrets, configuration, tokens, or unrelated user data.

Self-Modification

High

• Category: Rogue Agent

Content

description: >-
  Design agent-native applications where agents replace UI users as the primary
  actor. Use when designing MCP tools, agent-loop architectures, system prompt
  design, hooks policy, shared-workspace file patterns, or self-modifying agent
  systems.
---

• Confidence: 95% confidence
• Finding: self-modify

Self-Modification

High

• Category: Rogue Agent

Content

| 6, "prompt", "system prompt", "behavior" | Read [system-prompt-design.md](./references/system-prompt-design.md) |
| 7, "context", "inject", "runtime", "dynamic" | Read [dynamic-context-injection.md](./references/dynamic-context-injection.md) |
| 8, "parity", "ui action", "capability map" | Read [action-parity-discipline.md](./references/action-parity-discipline.md) |
| 9, "self-modify", "evolve", "git" | Read [self-modification.md](./references/self-modification.md) |
| 10, "product", "progressive", "approval", "latent demand" | Read [product-implications.md](./references/product-implications.md) |
| 11, "mobile", "ios", "android", "background", "checkpoint" | Read [mobile-patterns.md](./references/mobile-patterns.md) |
| 11a, "icloud", "storage", "documents", "file state", "entitlement" | Read [mobile-storage.md](./references/mobile-storage.md) |

• Confidence: 94% confidence
• Finding: self-modify

Session Persistence

Medium

• Category: Rogue Agent

Content

**Agent-native applications get better through accumulated context and prompt refinement.**

**Accumulated context:** The agent can maintain state across sessions. A `context.md` file the agent reads and updates is layer one. More sophisticated approaches involve structured memory and learned preferences.

**Prompt refinement at multiple levels:**
- **Developer level:** You ship updated prompts that change agent behavior for all users

• Confidence: 82% confidence
• Finding: maintain state across sessions

Self-Modification

High

• Category: Rogue Agent

Content

<why_self_modification>
## Why Self-Modification?

Traditional software is static--it does what you wrote, nothing more. Self-modifying agents can:

- **Fix their own bugs** - See an error, patch the code, restart
- **Add new capabilities** - User asks for something new, agent implements it

• Confidence: 95% confidence
• Finding: Self-modify

VirusTotal

63/63 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: references/action-parity-discipline.md:248

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: references/agent-execution-patterns.md:248

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: references/agent-native-testing.md:215

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: references/architecture-patterns.md:53

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: references/dynamic-context-injection.md:161

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: references/quick-start.md:31

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: references/refactoring-to-prompt-native.md:184

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: references/system-prompt-design.md:42