Security audit

计划验证器

Security checks across malware telemetry and agentic risk

Overview

This skill appears safe to install, but it is much weaker than its description suggests and should not be trusted as a real safety gate.

Install only if you treat this as a lightweight checklist or example. Do not rely on it to approve important agent plans; independently verify tools, permissions, credentials, dependencies, and execution risks before acting.

SkillSpector

By NVIDIA

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Description-Behavior Mismatch

Medium

Confidence: 98% confidence
Finding: This skill advertises pre-execution validation of tool availability, permissions, dependencies, and feasibility, but the implementation only checks for a few JSON fields and whether each step has a 'tool' key. In an agent pipeline, this can create a false sense of safety and allow hallucinated or impossible plans to pass validation, leading downstream components to execute unsafe, failing, or unauthorized actions.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The documentation claims the module prevents hallucinated planning and validates realism, but the code does not perform those checks and the only realism function returns a hardcoded success result. This mismatch is dangerous because operators or orchestration systems may trust the skill as a security or safety gate when it is effectively non-functional for the advertised purpose.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.