Security audit

C Disk Cleanup

Security checks across malware telemetry and agentic risk

Overview

This Windows cleanup skill is mostly purpose-aligned, but it includes under-scoped system and file-move powers that users should review carefully before installing.

Install only if you are comfortable with a local Windows cleanup helper that can scan C:, move files after confirmation, store cleanup preferences, and potentially guide advanced system cleanup. Before using it, avoid approving Program Files compression, CompactOS/DISM changes, or arbitrary folder moves unless you understand the rollback path and have backups.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The workflow introduces in-place system modification actions such as NTFS compression under Program Files and DISM/CompactOS cleanup, which contradict the skill’s stated safety model of read-only assessment and relocation-only cleanup. Even with user confirmation, these operations can affect system stability, application behavior, update/uninstall paths, and recoverability, creating a materially riskier execution path than the manifest implies.

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: The skill description says software program directories will not be touched, but the workflow explicitly runs compact.exe against Program Files paths. This mismatch is dangerous because it defeats user expectations and consent boundaries: a user agreeing to 'only move files' may unknowingly authorize changes to installed software locations, increasing the chance of breakage or data loss from misunderstood scope.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The function `Test-SafeToMove` presents itself as a safety gate, but its fallback branch returns `Ok=$true` for any path that does not match a denylist entry. That means arbitrary directories outside cache/temp/user-file areas can still be moved or sent to the recycle bin once `-Confirmed` is supplied, undermining the script’s own safety guarantees and enabling destructive handling of important application or system data.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The comment claims unmatched paths are 'mostly cache' and therefore allowed, but the code performs no validation that the target is actually cache or temporary data. In a disk-cleanup skill aimed at non-technical users, this mismatch is dangerous because users may trust the script’s messaging and approve moves of arbitrary folders that can break applications or disrupt data availability.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The description states the skill supports periodic automatic checks and daily-use behavior, but the activation boundary is not crisply defined in the metadata/triggering text. Ambiguous auto-activation is risky here because even read-only scanning reveals local disk usage patterns, and the skill also stores preferences and may later perform semi-automated cleanup actions based on remembered habits.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The description states the skill supports periodic automatic checks and daily-use behavior, but the activation boundary is not crisply defined in the metadata/triggering text. Ambiguous auto-activation is risky here because even read-only scanning reveals local disk usage patterns, and the skill also stores preferences and may later perform semi-automated cleanup actions based on remembered habits.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The promo text instructs users to invoke the skill with a very common phrase meaning 'my C drive is full.' Such ordinary-language triggers can be activated during normal conversation, troubleshooting, or quoted text, causing the cleanup skill to start unintentionally. In a file-management skill, accidental activation is more sensitive because it may initiate scans, habit-based automation, or lead users into approving disk operations they did not intend to start.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.