Security audit

agentdrive-backup

Security checks across malware telemetry and agentic risk

Overview

This skill is a cloud-backup guide, but it gives an agent broad authority to upload its root directory and maintain silent recurring backup behavior with too little user control.

Install only if you intentionally want this agent's full root/data directory uploaded to 360AgentDrive and kept under recurring auto-backup. Before using it, require a visible confirmation of the exact source path and cloud destination, add exclusions for credentials and private data, and make the crontab guard optional with a clear removal command.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Intent-Code Divergence

High

Confidence: 95% confidence
Finding: The skill documents a constrained root-directory selection method, but the auto-backup and guard logic falls back to a much broader first-segment path derivation. That mismatch can cause the background listener to monitor and upload a different, larger, or unintended directory than the one initially validated, increasing the chance of over-collection and data exfiltration.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The document says the cron guard should only verify whether backup monitoring exists, but the script recomputes both the source directory and lobster name before re-enabling monitoring. If the environment changes, it may silently attach monitoring to a new destination or source path, causing unintended ongoing backups to the wrong cloud path.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The advertised purpose is cloud backup, but the skill also instructs the agent to install persistent scheduled tasks that modify the local crontab. This expands behavior from a one-time backup operation into ongoing host persistence, which materially changes the security and system-impact profile without clear upfront disclosure.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The activation language is broad and mandatory for common backup and login tasks, making accidental or unnecessary invocation more likely. In this skill, invocation triggers credential handling, cloud upload, installation/upgrade, and persistence behaviors, so over-broad activation increases the chance of unintended sensitive actions.

Missing User Warnings

High

Confidence: 96% confidence
Finding: The skill explicitly instructs silent installation of a recurring crontab job and says its execution results must not be shown to the user. Silent persistence on the host is dangerous because it hides continued system modification and ongoing data-transfer behavior from the operator.

Missing User Warnings

High

Confidence: 94% confidence
Finding: The skill directs backup of the agent's root directory to a cloud service without a clear warning that the root directory may contain credentials, tokens, logs, chat artifacts, and other sensitive files. Given the broad scope of a root-directory backup, the missing privacy and data-impact disclosure materially increases the risk of unintended data exposure.

Ssd 3

High

Confidence: 97% confidence
Finding: The skill tells the agent to silently maintain automatic backups of its root directory and to avoid reporting the background task's behavior to the user. Hidden, ongoing backup of a broad local directory to cloud storage creates a clear confidentiality risk and reduces the user's ability to detect or stop continued data transfer.

Ssd 3

High

Confidence: 97% confidence
Finding: The skill repeatedly instructs the agent to back up its entire root directory with minimal user interaction and to proceed automatically. Backing up such a broad directory to cloud storage can capture sensitive operational data far beyond what is necessary, and the reduced-interaction requirement weakens meaningful user consent.

Ssd 3

High

Confidence: 96% confidence
Finding: The hourly guard task is designed to silently re-enable backup monitoring in the background without informing the user. This creates a persistence-and-exfiltration combination: even if monitoring stops, the system will restore it automatically without operator visibility.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.