Back to skill

Security audit

Chaos Lab

Security checks across malware telemetry and agentic risk

Overview

Chaos Lab is a disclosed AI-safety demo that sends sandbox files to Gemini and writes local logs, with no evidence of hidden execution, persistence, or destructive code.

Install only if you are comfortable sending the contents of /tmp/chaos-sandbox to Google's Gemini API. Use dummy data or deliberately selected files, keep secrets and private projects out of the sandbox, protect and restrict the Gemini API key, and do not enable the optional tool-access path without strong sandbox checks, approvals, and rollback.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (19)

Lp3

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding
The skill documentation describes behavior that implies local file reads, local file writes, and outbound network access, yet no permissions are declared. This reduces transparency and informed consent for users, especially because the framework is explicitly designed to analyze a workspace and send content to Gemini, which can expose local data unexpectedly.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The stated purpose focuses on alignment research, but the documented workflow also includes reading workspace contents, loading credentials from the user's home directory, sending data to the Gemini API, and writing logs locally. That mismatch is dangerous because users may consent to a harmless research demo without realizing it can transmit local content and handle secrets.

Intent-Code Divergence

Medium
Confidence
91% confidence
Finding
The safety notes say agents have no tool access and do not modify files, but the same document instructs users to run scripts that use an API key and make external calls. Even if the model itself lacks direct tools, the overall skill still causes data handling and network activity, so the safety section is materially misleading.

Context-Inappropriate Capability

Medium
Confidence
97% confidence
Finding
The script reads a local API key from a secrets file and then uses that credential to send workspace-derived content to an external Gemini endpoint. In context, the skill is framed as a local 'chaos lab' experiment, so silently coupling local secret access with remote transmission expands trust boundaries and can expose sensitive data from the sandbox without clear necessity or consent.

Description-Behavior Mismatch

Medium
Confidence
99% confidence
Finding
The code reads essentially all non-.py and non-.md files under /tmp/chaos-sandbox, concatenates their contents, and sends them to a third-party API for analysis. That is dangerous because arbitrary local workspace data may include secrets, proprietary material, or personal information, and the skill description does not justify exporting the full workspace off-host.

Missing User Warnings

Low
Confidence
69% confidence
Finding
The setup instructions tell users to place a live API key in a local .env file but do not include a clear warning about protecting credentials, avoiding commits, or limiting key scope. This increases the chance of accidental exposure through shell history, backups, screenshots, or source control.

Missing User Warnings

High
Confidence
95% confidence
Finding
The file contains explicit instructions/results describing deletion of directories, truncation of logs, renaming of files, and modification of configuration and log data without any warning, approval gate, or rollback guidance. In a skill whose purpose is to explore chaotic multi-agent behavior, presenting destructive workspace changes as acceptable output increases the chance an operator or downstream agent will imitate or automate harmful actions.

Missing User Warnings

High
Confidence
97% confidence
Finding
The content recommends moving all operational files to /tmp and frames the result as beneficial, without warning that /tmp is typically ephemeral and may be world-accessible or cleared on reboot. This can directly cause data loss, break monitoring, and encourage unsafe operational practices, especially in a chaos-oriented skill where agents may already take aggressive actions.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
This section includes a shell script that deletes the original log file (`rm "$LOG_FILE"`) after compression, without any warning about potential data loss or safety considerations. In a skill intended to guide multi-agent workspace operations, users may copy and run the script directly, making the destructive behavior materially risky even if presented as an example.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The script reads the entire sandbox contents and sends them to an external Gemini API as part of the prompt without any user confirmation, filtering, or warning. If the sandbox contains secrets, proprietary code, personal data, or prompt-injection content, this causes unintended third-party disclosure and expands the blast radius of any sensitive file placed in the workspace.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
At the point the workspace is packaged into the prompt and used for agent analysis, the user receives only generic progress messages rather than a clear warning that local file contents are being sent to Google Gemini. Lack of meaningful notice prevents informed consent and increases the chance of accidental disclosure of sensitive local data.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The outbound requests.post call transmits prompt data to an external endpoint, but the script does not clearly disclose this behavior to the user. Hidden or under-disclosed network transmission is risky because it can leak local content beyond the user's expectations and organizational controls.

Missing User Warnings

Low
Confidence
86% confidence
Finding
Automatically reading a credential from ~/.config/chaos-lab/.env without explanation is a transparency problem because users may not realize the script is accessing a local secrets store. While reading one's own config is common, doing so silently in a tool that also performs external transmission increases the chance of misuse and confusion.

Ssd 3

Medium
Confidence
96% confidence
Finding
The program recursively ingests sandbox files, embeds them into prompts, and then persists model outputs to a markdown log file without any data minimization, redaction, or retention controls. This can duplicate sensitive workspace contents into both a third-party API and a local artifact, increasing exposure and making accidental disclosure more likely.

Ssd 3

Medium
Confidence
85% confidence
Finding
The Gopher persona explicitly encourages preserving everything, creating repeated backups, and never deleting anything. In a system that ingests workspace contents and logs model outputs, this increases the likelihood that sensitive data will be replicated, retained longer than necessary, and surfaced repeatedly in generated text.

Ssd 4

Medium
Confidence
79% confidence
Finding
The multi-agent setup normalizes increasingly unsafe data-handling behaviors: autonomous modification pressure, indiscriminate threat hoarding, and obsessive duplication. In this skill context, those personas are not merely fictional; they shape how sensitive workspace data is collected, repeated, and transmitted, increasing the risk of overcollection and harmful recommendations.

External Transmission

Medium
Category
Data Exfiltration
Content
}
    }
    
    response = requests.post(url, json=payload)
    if response.status_code == 200:
        data = response.json()
        return data["candidates"][0]["content"]["parts"][0]["text"]
Confidence
88% confidence
Finding
requests.post(url, json=

External Transmission

Medium
Category
Data Exfiltration
Content
}
    }
    
    response = requests.post(url, json=payload)
    if response.status_code == 200:
        data = response.json()
        return data["candidates"][0]["content"]["parts"][0]["text"]
Confidence
98% confidence
Finding
requests.post(url, json=

Credential Access

High
Category
Privilege Escalation
Content
# Store your Gemini API key
mkdir -p ~/.config/chaos-lab
echo "GEMINI_API_KEY=your_key_here" > ~/.config/chaos-lab/.env
chmod 600 ~/.config/chaos-lab/.env

# Install dependencies
pip3 install requests
Confidence
84% confidence
Finding
.env

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.