Security audit

SKILL

Security checks across malware telemetry and agentic risk

Overview

This skill is mostly aligned with enterprise AI deployment governance, but it grants broad operational authority and persistent local memory without enough scoping for a normal install.

Review before installing. This is a deployment and governance harness, not just documentation: expect it to create local state, run orchestrators, write logs/knowledge, activate agents, and possibly use daemons or removable media. Use it only in a controlled enterprise workspace, avoid feeding secrets or regulated data unless redaction and retention are configured, and require human confirmation for install, activation, snapshot, market, USB, and any shell-orchestrated action.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (25)

Description-Behavior Mismatch

Medium

Confidence: 77% confidence
Finding: The skill claims a constrained governance role ('不写应用代码') while also directing creation of enterprise-specific skills and deployment artifacts. That mismatch can mislead users and downstream agents about the true operational scope, causing the skill to perform broader changes than expected without appropriate scrutiny or approval.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: Market publish/invoke/rate/retire capabilities materially expand the skill from governance guidance into execution of externally sourced or shared capabilities. If those actions are not tightly scoped and user-approved, they create a supply-chain and privilege-expansion risk by enabling import or execution of untrusted artifacts beyond the skill's stated audit purpose.

Context-Inappropriate Capability

Medium

Confidence: 82% confidence
Finding: Snapshot restore is an operationally powerful rollback action that exceeds a read-oriented diagnosis or methodology role. If triggered inappropriately, it can overwrite current state, revert security fixes, or disrupt services, especially when the skill's broad triggers may activate in routine enterprise conversations.

Intent-Code Divergence

Medium

Confidence: 80% confidence
Finding: The skill says sensitive data must not be stored or forwarded, yet it also instructs reading and writing persistent reflection and knowledge-base content. Without explicit minimization and redaction guarantees, operators may incorrectly assume persistence is safe and end up storing sensitive enterprise information in think logs or knowledge files.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The skill explicitly instructs the agent to pass the user task verbatim into a Bash command that invokes an external orchestration engine. This creates an execution boundary crossing where untrusted user input may trigger unintended command behavior, downstream prompt injection, or unauthorized actions by the subagent, especially since this is framed as the mandatory audit entrypoint for all agents.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The skill states it does not write application code, but it clearly instructs the agent to provision, activate, and leave behind runnable agent software on target systems. That mismatch can mislead operators and downstream policy checks, causing deployment actions to be treated as low-risk configuration work when they are actually software installation and activation steps.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The document promises 'minimal invasion' limited to .sofagent/ and constraint files, but later directs broader activation, workflow composition, agent registration, daemon scheduling, audit setup, and persistent runtime operation. This inconsistency can cause unauthorized or unexpected system changes because reviewers may approve it under a narrower change model than what is actually executed.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The template expands the skill from stated behavior constraints and auditing into persistent knowledge-base maintenance, ingestion, and automatic injection into future sessions. That creates an unbounded data-flow channel where prior task logs can be transformed into prompts and reintroduced later, increasing the risk of prompt injection persistence, sensitive data retention, and behavior drift beyond the declared scope.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The daemon-triggered extraction and top-3 page session injection describe autonomous processing of accumulated logs and automatic prompt augmentation. In a security-sensitive agent skill, this is dangerous because untrusted or sensitive content from logs can become a persistent indirect prompt-injection source, influencing later sessions without fresh user consent or review.

Context-Inappropriate Capability

Medium

Confidence: 82% confidence
Finding: The task gate instructs the agent to access an external GitHub repository to perform role matching, which expands the skill's authority from local gating/auditing into network retrieval. Because skill content is untrusted and the fetched repository content can change independently, this creates a prompt-supply-chain risk and can influence later agent behavior with unreviewed external data.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The document states that every run writes reports into `.sofagent/` but does not prominently warn users about filesystem side effects, retention, or possible sensitive content in audit artifacts. In an enterprise deployment skill handling workflows, compliance, and potentially financial or operational data, silent local persistence can create confidentiality and governance risks if reports contain secrets, internal topology, or incident details.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The trigger phrases are broad and overlap with ordinary enterprise discussions such as deployment, workflow review, optimization, and inspection. That increases the chance of accidental invocation of a skill that can read/write persistent files and recommend or initiate operational actions, creating confused-deputy behavior and unexpected side effects.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill describes writing to local runtime paths such as custom skill directories but does not prominently warn users that local files may be created or modified. This weakens informed consent and can lead to silent persistence of behavior-changing artifacts in the agent runtime.

Vague Triggers

Medium

Confidence: 77% confidence
Finding: The trigger list includes broad operational terms such as '审计' and '巡检', which can cause the skill to activate in situations beyond the author's intended scope. Over-broad auto-invocation is risky here because activation leads to delegating tasks into an external audit engine, increasing the chance of unintended execution, data exposure, or policy bypass in normal conversations.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: The trigger list includes broad natural-language phrases such as '改代码' and '实现功能', which are common in ordinary conversations and can cause the skill to activate outside narrowly intended contexts. In an agent system, over-broad activation expands the situations where the skill’s prescriptive workflow and command recommendations are injected, increasing the chance of unintended tool use or behavioral steering.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The trigger list includes broad operational phrases such as deployment, inspection, continuous optimization, and even USB-related terms, which increases the chance the skill is invoked in contexts the user did not intend. Because this skill can initiate orchestration, deployment, activation, and removable-media workflows, overbroad matching materially raises the risk of unintended high-impact actions.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The USB creation instructions include a concrete target path and describe writing a packaged runtime to removable media, but they do not require an explicit destructive-action warning, target verification, or confirmation that the selected volume is correct. In practice, users may overwrite the wrong removable device or mis-handle sensitive enterprise knowledge material being staged onto portable media.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The activation logic uses broad phrases like “企业 AI 部署” and “工作流梳理” as strong or weak signals without clear exclusions, scope boundaries, or robust confirmation rules. In an agent skill, this can cause unintended activation of a high-impact guided workflow, leading the agent to create files, steer the conversation, and transition into deployment-oriented behavior when the user did not intend that mode.

Missing User Warnings

Low

Confidence: 91% confidence
Finding: The skill instructs the agent to append operational data to local task logs and even provides fallback direct file writes, but it does not require any user notification or consent before modifying persistent local state. In an agent setting, silent writes can violate user expectations, leave residue on the host, and create privacy/audit risks if task details, model IDs, token counts, or costs are stored automatically.

Missing User Warnings

Low

Confidence: 93% confidence
Finding: This section mandates additional persistent writes to think.md, eval/_index.md, and orchestrator/ and states they cannot be skipped, again without warning the user that local files will be created or modified. The danger is amplified because these files appear to capture reflections, evaluations, and orchestration state, which may store sensitive workflow details and accumulate over time without user awareness.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The activation condition is broad enough to trigger on generic terms like audit, 检查, or 巡检, which can cause the skill to load in contexts beyond its intended scope. In an agent-control skill, unintended activation can override or bias agent behavior, inject extra procedural constraints, or alter task handling in unrelated workflows, increasing the chance of mis-execution or policy interference.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The activation rule loads this role whenever a task mentions broad terms like '部署/install/activate/FDE', which can match many unrelated prompts and cause the skill to be injected unexpectedly. Because this skill constrains agent behavior and changes operating mode, unintended loading can alter task handling, increase prompt-surface area, and trigger enterprise-deployment workflows in contexts where they are not appropriate.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill explicitly tells the agent to record enterprise information locally when no MCP server is connected, but it provides no privacy, retention, access-control, or redaction guidance. Because the data being collected includes company identity, platforms, business systems, and key roles, local storage can create unnecessary exposure of sensitive business metadata and increase the risk of leakage across projects or users.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The phrase “随时说'回到 FDE'或'继续上次部署'恢复上下文” creates a broad natural-language trigger that can be invoked casually or by untrusted content quoted into the conversation. Because this skill governs deployment and sustained post-deployment operations, an unintended context restore could reactivate prior privileged workflow assumptions, causing the agent to resume sensitive actions under stale or attacker-influenced context.

Overly Broad Trigger

Low

Category: Trigger Abuse
Confidence: 78% confidence
Finding: The short trigger '巡检' is generic and likely to appear in normal operational conversations. On its own this would be minor, but in this skill it matters because invocation can lead to loading additional instructions and potentially stateful or operational behaviors, increasing accidental activation risk.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.