Security audit

Env Manager

Security checks across malware telemetry and agentic risk

Overview

This skill is a mostly coherent dev-environment helper, but its file-write scoping controls are misleading enough that users should review it before installing.

Install only if you are comfortable with a skill that creates local project directories, writes persistent JSON state, and runs local toolchain commands. Do not rely on --dir or --dry-run as containment controls until fixed; run it only in a workspace where unintended scaffold files are acceptable.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill documentation describes capabilities to execute local binaries, inspect the environment, and manage files, but the skill declares no permissions. This creates a trust and review gap: an agent or user may invoke shell-capable behavior without an explicit permission boundary, increasing the chance of unsafe execution in sensitive environments.

Intent-Code Divergence

Medium

Confidence: 77% confidence
Finding: The documentation is internally inconsistent about service management: it advertises start/stop and health-check behavior while later claiming service management is only state tracking with no actual process control. This kind of mismatch can cause operators or higher-level agents to authorize or rely on behavior they do not accurately understand, which is dangerous when shell execution and local system interaction are involved.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The `--dir` option writes directly to `process.env.ENV_DIR`, but `WORKSPACE`, `DATA_DIR`, and related paths are computed earlier at module load time, so the override is ineffective and may mislead users about where files will be created. In an agent setting, path-selection features that are undocumented or misleading are dangerous because they can cause writes into unintended workspace locations, especially when operators assume isolation controls are in effect.

Missing User Warnings

Medium

Confidence: 81% confidence
Finding: The Go setup path invokes `safeExecShell` with a shell command string (`cd ... && go mod init ...`). Although `envName` is validated and `envDir` is derived from trusted components, using a shell at all expands the attack surface and makes future regressions more likely if validation changes or additional parameters are added. In a dev-environment manager skill, command execution is expected, which lowers suspicion somewhat, but shell use remains riskier than argument-array execution.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: env-manager.js:111