Security audit

Scan Skill

Security checks across malware telemetry and agentic risk

Overview

This is a security-scanning skill whose behavior matches its purpose, with the main caveat that it may contact PyPI or npm to verify package names found during a scan.

Install this if you want a user-invoked skill security scanner. Run it only on skill directories you intend to analyze, and avoid scanning private projects with confidential internal package names if contacting PyPI or npm with those names is unacceptable.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The module for a local skill scanner also performs live outbound registry lookups to PyPI and npm, which extends behavior beyond pure static/offline analysis. This creates privacy, determinism, and trust-boundary concerns because scanning a file can unexpectedly trigger external network access and disclose package interests or repository contents indirectly.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The code issues direct HTTP requests to public registries without a strong in-code justification tied to the advertised purpose of scanning an individual skill. In a security-analysis tool, unexpected network access is risky because it broadens attack surface, may fail unpredictably, and can leak metadata about what is being analyzed.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: Outbound HTTP requests are performed from verification logic with no obvious user-facing disclosure at the execution point. Silent network behavior in a scanner is security-relevant because users may assume purely local analysis while the tool contacts third parties.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec, suspicious.dynamic_code_execution

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/patterns.py:357

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/patterns.py:350