Security audit

Axioma Skill Evaluator

Security checks across malware telemetry and agentic risk

Overview

This skill is a local evaluator, but it needs review because it writes to hard-coded personal paths and includes misleading evaluation reports.

Treat this as an advisory local evaluator, not an authoritative approval gate. Run it only on explicit skill folders, avoid --all unless you have reviewed the hard-coded scan roots, and manually verify scores because bundled reports contain threshold contradictions.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill advertises and instructs execution of bundled Python tools that imply shell, filesystem, environment, and possibly network access, yet the skill declares no permissions or capability boundaries. That omission can mislead users and orchestration systems about what the skill is allowed to do, reducing informed consent and making unintended file access or external actions more likely.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: This is a significant description-behavior mismatch: the skill claims to evaluate a provided target skill, but the associated behavior reportedly scans hardcoded local directories, writes reports outside the target, and depends on environment-specific paths. Such undeclared behavior expands scope beyond user intent and can expose unrelated local data or modify files in unexpected locations.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: When run with --all, the evaluator recursively scans hard-coded host directories outside the user-supplied target, expanding file-system reach beyond a normal single-skill audit. In a shared or sensitive environment, this can expose metadata or contents from unrelated skills and violates least-privilege expectations for the tool.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The report contains a direct integrity contradiction: it assigns a score of 64/100 and marks the skill as NEEDS_WORK, yet the final status says APPROVED with a threshold of score >= 70. This can mislead reviewers or automated pipelines into accepting a skill that failed its own criteria, weakening publication or audit controls.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The report states a score of 66/100 with a rating of NEEDS_WORK, but the final line says APPROVED (score >= 70%), which is internally inconsistent. In a skill-evaluation context, this can mislead reviewers into trusting or publishing a skill that failed its own quality gate, undermining audit integrity and potentially allowing unsafe or low-quality skills to pass review.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The report declares a score of 56/100 and labels it NEEDS_WORK, but later states APPROVED with a threshold of score >= 70. This internal contradiction can mislead reviewers or automation into accepting an under-threshold skill, weakening governance and allowing low-quality or risky skills to pass review.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The tool automatically writes evaluation reports to a fixed reports directory without user opt-in or prominent disclosure. Those reports may contain skill names, paths, and analyzed content-derived details, creating an unintended persistence and information-leak risk on multi-user systems or in environments handling proprietary skills.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.