Security audit

Audit Code

Security checks across malware telemetry and agentic risk

Overview

This is a coherent code-auditing skill, but it may read sensitive project files and check detected package names against public registries.

Install if you want a repository security scanner and are comfortable with it reading the selected project, including .env-like files, and printing matched snippets in the report. Avoid it or run it with network egress blocked if private dependency names must not be sent to PyPI or npm.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill declares no explicit permissions, yet it is configured with Read, Glob, Grep, and Bash and instructs execution of a Python script that can inspect the filesystem and potentially perform shell and network-capable operations indirectly. This creates a capability/permission transparency gap: users may underestimate what the skill can access or do, which is risky in a security-review skill that scans broad project paths by default.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The documented purpose says the skill performs code security review, but the detected behavior includes live external registry lookups, filesystem permission inspection, and repository hygiene checks that go beyond a narrow static code audit. That mismatch matters because users may invoke the skill expecting local-only analysis while it may reach external services or inspect additional sensitive metadata, increasing privacy and operational risk.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: This module extends a nominally local/static code-audit skill with live package-registry verification logic, which changes the trust and execution boundary from offline scanning to networked analysis. That broadening is security-relevant because it introduces outbound communication, nondeterministic behavior, and privacy/leakage concerns not obvious from the skill description.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: Verify_Package performs outbound HTTP requests to PyPI and npm, creating external network capability inside a code-review helper. In constrained or privacy-sensitive environments, this can leak repository-derived package names and violate assumptions that analysis is purely local.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The package-verification flow sends extracted package names to third-party registries without any in-code warning, consent mechanism, or privacy notice. Even if package names seem low sensitivity, they can disclose unreleased products, internal dependency choices, or investigation targets.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec, suspicious.dynamic_code_execution

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/patterns.py:357

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/patterns.py:350