Security audit

Agent Workflow Skill

Security checks across malware telemetry and agentic risk

Overview

This is a small workflow-planning demo that uses OpenAI for task decomposition and only runs stubbed local tools, with no evidence of hidden persistence, destruction, or credential theft.

Install only if you are comfortable providing an OpenAI API key and sending task descriptions to OpenAI. Review generated task graphs before running them, and be especially cautious if you extend the placeholder tool registry to real tools that can modify files, accounts, production systems, or public content.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The skill claims to decompose tasks, but the described and inferred behavior extends into generating workflows through an external model, executing them, invoking tools, and parallelizing operations. That mismatch is dangerous because users or calling systems may grant trust and activation based on a narrow description while the skill can actually perform materially broader actions, including external calls and autonomous execution.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The executor dynamically selects and invokes tools based on substring matches in untrusted task text, which gives task content implicit control over capability execution. In a task-graph executor, this is dangerous because arbitrary or unintended tools may run with side effects, turning workflow orchestration into prompt-driven capability dispatch without explicit authorization boundaries.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: This code loads an API key from the environment and initializes an external OpenAI client, enabling transmission of user task content to a third-party service. For a skill presented as a DAG task executor, this creates an unexpected data-exfiltration path and expands capability beyond local planning/execution, which is risky if users are not informed or if sensitive requests are processed.

Description-Behavior Mismatch

Medium

Confidence: 80% confidence
Finding: The file primarily performs remote LLM-based task generation rather than DAG execution, creating a mismatch between the advertised skill purpose and its actual behavior. That mismatch is security-relevant because reviewers and users may underestimate that their raw requests are being sent externally and processed probabilistically rather than by constrained local DAG logic.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The activation guidance is broad enough to match many ordinary requests, which increases the chance this skill is invoked in contexts where users did not intend autonomous multi-step execution. In a workflow-executing skill, overbroad triggering is riskier than usual because activation may lead to repository access, external operations, or chained tool usage without sufficiently specific consent.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The markdown explicitly references impactful actions like cloning repositories and executing tasks but does not warn about external network access, local system effects, data handling, or side effects from parallel execution. In this context, omission of such warnings makes the skill more dangerous because it normalizes operational actions without communicating boundaries or requiring consent.

Missing User Warnings

Medium

Confidence: 82% confidence
Finding: Tool execution occurs directly from task-derived text with no warning, approval gate, or documentation of possible side effects, so users and integrators may not realize that executing a DAG can perform real actions. This increases the likelihood of unsafe use, especially when combined with dynamic dispatch from task names, because benign-looking workflow steps can trigger external capabilities unexpectedly.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The code sends `user_input` directly to an external chat completion API without any disclosure, consent, or visible filtering in this file. If users provide secrets, internal data, or regulated information, that content may be exposed to a third party unexpectedly, making this a genuine privacy and data-handling issue.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.