Build an Agent with Warden

• Outcome: Pass
• Latest audit: May 28, 2026, 4:37 AM
• Version:
  1.0.0

Overview

This skill appears to be a coherent Warden/LangGraph agent-building guide with expected scripts, deployment examples, and API-key usage, not hidden or deceptive behavior.

Before installing, review the bundled Python scripts, run them only in a project directory you control, keep real API keys out of Git and logs, use deployment secret managers for production, and protect any public agent endpoint with authentication, rate limits, and monitoring.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger conditions are broad enough to activate on generic requests about "LangGraph agents," even when the user may not be asking for Warden-specific functionality. In an agentic system, over-broad auto-invocation can cause unintended context injection, tool usage, or steering toward external workflows and scripts that are irrelevant to the user's intent.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: Saying the skill automatically triggers when users mention "Warden or LangGraph agents" is ambiguous and can cause the skill to activate for many unrelated agent-building conversations. In this context, the skill contains deployment guidance, external links, and script references, so accidental activation increases the risk of inappropriate instructions or unnecessary exposure to potentially sensitive build/deployment workflows.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill instructs users to place multiple API keys in a .env file but does not warn that these credentials are sensitive, should never be committed to source control, and must not be exposed in logs, screenshots, or shared repositories. This creates a realistic risk of credential leakage, especially because the same document also encourages GitHub-based deployment workflows that commonly lead to accidental .env commits.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The deployment and registration guidance tells users to provide API keys and expose public HTTPS endpoints, but omits critical warnings about secure secret distribution, endpoint hardening, and the risks of publishing authenticated services to the internet. In this context, users may unintentionally deploy agents with weak authentication practices, overbroad exposure, or leaked API credentials during registration and testing.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The environment variable template includes many secret-bearing variables and an example database connection string without any warning not to commit populated .env files. In a builder/deployment skill, this can normalize unsafe secret handling and increase the chance that users place real credentials in tracked files or documentation, leading to accidental credential exposure.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The logging examples explicitly show recording request processing context and include `logger.debug('Processing request', { input })`, which can capture raw user prompts or sensitive payloads without any guidance on redaction, minimization, or retention. In an agent deployment guide, this is risky because users may copy the pattern directly into production and inadvertently store secrets, personal data, or wallet-related inputs in logs.

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: The documented auto-trigger phrases are broad enough to activate the skill for generic informational queries like asking about Warden or agents. In an agent system, overbroad triggering can cause unintended loading of instructions, references, or helper scripts, increasing the chance of context poisoning, unnecessary tool use, or user confusion in unrelated conversations.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The guide instructs users to change permissions and use local scripts without warning that these actions modify the local environment and may execute repository code. In a skill ecosystem where content is potentially untrusted, normalizing script execution without explicit caution raises the risk of users running unsafe code or making unintended system changes.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The examples invoke external LLM services with raw user input and, elsewhere in the document, derived analysis data, but the documentation does not warn builders about data disclosure, consent, or handling of sensitive information. In an agent-builder skill, omission of this guidance can lead downstream developers to unintentionally transmit secrets, wallet-related data, or private prompts to third-party providers.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The document instructs users to place sensitive API keys in environment configuration examples but does not warn against committing .env files, pasting secrets into shared channels, or otherwise exposing credentials. In a builder/deployment skill aimed at publishing agents, this omission increases the likelihood of accidental secret leakage during development and deployment.

VirusTotal

64/64 vendors flagged this skill as clean.