NVIDIA CUDA

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 6:45 AM UTC
• Version: 0.4.0

Overview

This NVIDIA CUDA skill is coherent and purpose-aligned, with optional local GPU probes and benchmarks but no hidden persistence, exfiltration, or destructive behavior found.

Install only if you want an agent to inspect CUDA/PyTorch runtime details and run local GPU benchmarks or code scans. Treat probe output as potentially sensitive system information, install PyTorch in an isolated environment, and prefer pinned CLI/package versions if you follow the optional publication or requirements commands.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:168

Finding

Mutable npm Package Execution Through npx

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unbounded PyTorch Dependency Version

Content

View full analysis

=2.11 ``` ### Technical Analysis The dependency constraint specifies only a minimum version and permits any future PyTorch release. Consequently, two installations performed at different times can resolve to different package versions that were not covered by the original audit. Python packages may execute code during installation, import, or runtime. If a future allowed release is compromised, malicious, or incompatible, installing from this requirement can introduce unreviewed behavior. The broad constraint also increases the chance of breaking API changes or altered CUDA runtime behavior affecting the bundled scripts. The requirement does not automatically install or execute the dependency. Exploitation requires a user or automation system to invoke a package installer against this file, and generally also requires compromise or substitution of a permitted distribution source. ### Attack Path 1. An attacker compromises an allowed future PyTorch distribution, package-publishing channel, package index, or dependency-resolution environment. 2. The compromised release still satisfies `torch>=2.11`. 3. A user or CI process runs a command such as `pip install -r requirements.txt`. 4. The package manager resolves and installs the compromised release. 5. Malicious installation or runtime code executes when the package is installed or imported by the bundled scripts. ### Impact Assessment A compromised dependency could execute code with the permissions of the installer or script runner. Potentially accessible resources include: - User-readable files and environment variables - GPU devices exposed to the process - Training code and data available in the runtime environment - Network destinations reachable from the host - Writable files owned by the invo ...[truncated 241 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/cuda_env_probe.py (reported line 61)May include surrounding context.

python

recommendations.append("CUDA is unavailable. Verify driver, runtime, and container visibility first.")
        return recommendations

    if any(token in names for token in ("H100", "H200", "B200", "BLACKWELL", "HOPPER")):
        recommendations.append("Prefer BF16 as the baseline precision on Hopper/Blackwell-class GPUs.")
    if any(token in names for token in ("H200", "B200", "BLACKWELL")):
        recommendations.append("Benchmark newer flash attention implementations and cuDNN/TE attention, not only the default SDPA path.")

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/cuda_env_probe.py (reported line 63)May include surrounding context.

python

recommendations.append("CUDA is unavailable. Verify driver, runtime, and container visibility first.")
        return recommendations

    if any(token in names for token in ("H100", "H200", "B200", "BLACKWELL", "HOPPER")):
        recommendations.append("Prefer BF16 as the baseline precision on Hopper/Blackwell-class GPUs.")
    if any(token in names for token in ("H200", "B200", "BLACKWELL")):
        recommendations.append("Benchmark newer flash attention implementations and cuDNN/TE attention, not only the default SDPA path.")

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 3)May include surrounding context.

md

# nvidia-cuda

`nvidia-cuda` is an open-source skill package for Codex, OpenClaw, and similar agent systems that need to write or review deep learning code for NVIDIA GPUs.

It is opinionated on purpose. The package encodes modern AI infra practice for H100, H200, and B200-class systems:

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 68)May include surrounding context.

md

### Codex

Copy this directory to your skills path as `~/.codex/skills/nvidia-cuda/`.

### OpenClaw / ClawHub-compatible agents

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The README recommends running npx clawhub@latest publish ., which fetches and executes the latest package version at publish time without pinning or prior verification. This creates a supply-chain risk: a compromised or malicious newly published version could execute arbitrary code on the publisher's machine or CI environment.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill instructs the agent to inspect local runtime state and files, including environment variables, hardware details, and local reference documents, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates an authorization gap: a caller may invoke a skill that implicitly relies on env and file-read capabilities without clear boundary-setting, increasing the chance of unintended disclosure of sensitive environment data or local file contents.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The dependency is specified as torch>=2.11 without an upper bound or exact pin, which makes builds non-reproducible and can silently pull in different releases over time. In a GPU/AI infrastructure skill centered on PyTorch, this increases supply-chain and stability risk because a vulnerable or breaking torch release could be installed without review.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

torch>=2.11

Unverifiable Dependency: torch has 16 known advisory(ies) (CVE-2025-2953 (PyTorch susceptible to local Denial of Service); CVE-2022-45907 (PyTorch vulnerable to arbitrary code execution); CVE-2025-32434 (PyTorch: `torch.load` with `weights_only=True` leads to remote code execution) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 87% confidence

Finding

requirements.txt references torch without pinning a specific version, while PyTorch has multiple published advisories affecting some releases. Because the manifest allows any version at or above 2.11, it is impossible to verify from this file alone whether installation will resolve to a safe version, and the skill's heavy reliance on PyTorch makes that uncertainty more significant.

Content

No source excerpt is available for this finding.