Security audit

env-manager

Security checks across malware telemetry and agentic risk

Overview

The skill mostly matches its scaffolding purpose, but it claims writes stay in the workspace while the code has an undocumented environment-variable override that can redirect file writes elsewhere.

Review before installing. The skill does not appear to run commands or use the network, but only install it where ENV_MANAGER_WORKSPACE cannot be set by untrusted callers, or after the publisher removes or constrains that override and updates the documentation.

SkillSpector

By NVIDIA

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The README makes a security-relevant claim that the skill only tracks metadata and does not perform process control, yet the documented CLI includes `--services --start/--stop` actions. That inconsistency can mislead an agent or reviewer about the skill's true capabilities, reducing scrutiny around whether it can influence runtime state or trigger operational actions.

Intent-Code Divergence

High

Confidence: 94% confidence
Finding: The README explicitly asserts that the skill does not run shell commands or use process-spawning modules, while also advertising CLI service start/stop operations. In an agentic environment, contradictory safety claims are dangerous because they may cause callers to trust the skill as non-executing when it appears to expose operational controls that could later be implemented unsafely or already behave differently than described.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The documentation says the data directory is the only thing the skill writes to, but elsewhere it states that setupEnvironment also creates per-project directories and overwrites starter files inside environments/<name>/. This inconsistency can mislead calling agents or reviewers about the skill's side effects, increasing the chance that it is invoked in contexts where unexpected file creation or overwrite inside the workspace causes damage.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The skill claims writes occur only inside the agent workspace, but getWorkspace() honors ENV_MANAGER_WORKSPACE and accepts any absolute path without verifying it is within the intended workspace root. An attacker or misconfigured caller that controls environment variables can redirect all JSON/scaffold writes to arbitrary filesystem locations the process can access, violating containment guarantees and potentially overwriting sensitive files.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The documentation explicitly says there is no environment-variable-based path redirection, yet the code implements ENV_MANAGER_WORKSPACE as a path override. This mismatch is security-relevant because operators or calling agents may trust the documented containment model and expose the skill in contexts where environment manipulation is possible, enabling unexpected writes outside the intended area.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.