Security audit

Skill Gatekeeper

Security checks across malware telemetry and agentic risk

Overview

This skill is a security gatekeeper, but its implementation can install and remove live skills before a trustworthy review boundary is established.

Review carefully before installing. The main risks are not evidence of malware, but a weak gatekeeping design: it can install a skill before auditing it, remove installed skills during quarantine, run a shell command built from the provided slug, and store a VirusTotal key locally. Use only with trusted slugs, avoid sensitive/private skills unless you are comfortable with VirusTotal hash lookups, and do not rely on its 'sandbox' wording as real process isolation.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill advertises and relies on shell execution and network access (e.g., running local scanners and querying VirusTotal) but does not declare corresponding permissions. This creates a mismatch between documented trust boundaries and actual capabilities, making review and policy enforcement weaker and increasing the risk of unexpected command execution or data egress.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The skill advertised as a gatekeeper/auditor directly installs external content by building and executing a package-manager command with a user-controlled slug. This expands the trust boundary from passive analysis to active code acquisition/execution and creates command-injection and supply-chain risk if the slug or installation path is not safely passed as arguments.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The code claims it is entering a sandboxed isolation environment, but in practice it only copies files into another local directory and performs static scanning. This can mislead users into overtrusting the result, because no process isolation, permission restriction, or safe execution boundary exists.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill sends artifacts or metadata to VirusTotal for cloud scanning but does not clearly warn users that third-party transmission may occur. This can expose proprietary code, secrets, filenames, or other sensitive metadata outside the local environment, which is especially risky for private or internal skills.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The VirusTotal API key is accepted on the command line and persisted to a local JSON config file without any visible warning, masking, or permission hardening. Command-line secrets may leak via shell history/process listings, and plaintext config storage increases the chance of credential disclosure to local attackers or other users on the system.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: gatekeeper.ts:269