Back to skill

Security audit

Scripting Utils

Security checks across malware telemetry and agentic risk

Overview

This is a broad scripting helper, but it needs review because some validation paths can run local code and the bundled bot references describe high-risk execution patterns without clear safety warnings.

Install only if you are comfortable with a broad scripting utility that may run local validation commands. Do not use it on untrusted Tcl or other scripts without sandboxing, review generated system-management commands before running them, verify the external ../json-utils dependency, and treat the bundled pbot applet/code-execution documentation as admin-only guidance for trusted environments.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (11)

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill advertises capabilities that imply file reading and shell command execution, but it does not declare permissions or boundaries for those actions. In an agent environment, undocumented execution and file access increase the risk of unintended command execution, data exposure, and misuse by downstream callers who assume the skill is metadata-only or low-privilege.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The document describes loading arbitrary external executables as applets and returning their output to users, which creates a broad command-execution surface. In the context of a 'scripting-utils' skill, this materially expands capability into bot-extensible arbitrary program execution and external integrations beyond simple validation/linting, increasing the chance of misuse or unsafe deployment.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The `cc` applet is explicitly documented as compiling and executing arbitrary user-supplied code in many languages. Even with a VM and no network, arbitrary execution plus filesystem access is a dangerous capability that can enable local data exposure, resource abuse, and sandbox escape attempts if exposed to untrusted users.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The debugger features, especially `gdb("command")`, provide a passthrough to debugger commands against executed code. This greatly increases introspection and attack surface, potentially exposing process memory, filesystem details, runtime metadata, or facilitating sandbox probing beyond ordinary script validation.

Context-Inappropriate Capability

High
Confidence
96% confidence
Finding
The document explicitly describes Code Factoids that execute text in scripting/programming languages and applets that run external command-line programs. In the context of a broadly available 'scripting-utils' skill, this materially enables arbitrary code execution patterns and operationalizes running external programs, which is dangerous if exposed to untrusted users or reused by an agent without strict boundaries.

Context-Inappropriate Capability

High
Confidence
94% confidence
Finding
This section documents use of `cap-override` to allow an unprivileged user to invoke the `kick` command through a factoid. That is effectively a privilege-bypass pattern: it teaches capability delegation/escalation through indirection, which can weaken access-control expectations and be abused to expose sensitive admin actions to broader audiences.

Vague Triggers

Medium
Confidence
80% confidence
Finding
The description is extremely broad and can cause the agent to invoke this skill for many ordinary scripting, validation, system-management, and web-search tasks. Because the skill also suggests shell and file-read capabilities, overbroad routing increases the chance that sensitive or higher-risk actions are delegated to it without sufficient scrutiny.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The documentation normalizes arbitrary code execution, filesystem access, and external paste-site publication without prominent safety or privacy warnings. Users may unknowingly expose sensitive code/data to third parties or assume the environment is safer than it is, leading to misuse and data leakage.

Missing User Warnings

Low
Confidence
88% confidence
Finding
The `google`, `dict`, and related applets transmit user-supplied queries to external services, but the documentation does not warn about privacy implications. This can leak sensitive prompts, names, internal terms, or investigation topics to third parties and logs.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The `my` command example shows account metadata including `password => <private>` and describes manipulation of user metadata without any privacy or data-handling warning. Even though the password value is redacted in output, documenting password-bearing metadata and self-service account fields without caution can normalize insecure storage patterns and increase risk of accidental disclosure or poor downstream implementations.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
print(cmd)
    else:
        print(f"Executing: {cmd}")
        # subprocess.run(cmd, shell=True)  # Uncomment to actually execute


if __name__ == "__main__":
Confidence
98% confidence
Finding
subprocess.run(cmd, shell=True

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.