Security audit

Supervision Layer

Security checks across malware telemetry and agentic risk

Overview

This is a plausible local supervision helper, but it overstates non-bypassable protection and persists potentially sensitive audit and crash-state data with weak disclosure.

Use this only as an opt-in Python helper, not as guaranteed platform enforcement. Configure a controlled log directory, treat audit logs as sensitive, avoid passing secrets or full raw tool arguments into args_summary, and require fixes for redaction, HALF_OPEN circuit limiting, crash-loop recovery, and clearer storage/retention disclosure before production use.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill advertises operational supervision features that inherently touch logs and persisted state, yet the manifest declares no permissions despite detected environment and file read/write capabilities. This creates a transparency and policy-enforcement gap: hosts or users may approve the skill without understanding it can read environment-derived configuration and write persistent artifacts, increasing the chance of unintended data exposure or unauthorized persistence.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill claims an unbypassable supervision layer, but the described behavior shows supervision is optional and includes additional persistence, query, and reset surfaces not reflected in the core promise. This is dangerous because integrators may rely on it as a security boundary or mandatory control when it is only a library-style wrapper, enabling agents or callers to bypass logging, timeouts, or circuit protection entirely while still appearing protected.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: This is a real implementation flaw: when the circuit transitions from OPEN to HALF_OPEN, `can_call()` returns `True`, and subsequent concurrent callers seeing `HALF_OPEN` also return `True` without any gating. That violates the stated single-probe recovery model and can let many requests hit an unhealthy tool at once, undermining the protection layer and enabling budget burn, retry storms, or continued overload during recovery.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: This is a real logic flaw: once an agent reaches the restart threshold, `permanently_failed` is set to `True`, but later pruning only reduces `crash_count` and never clears the permanent failure flag. That means a worker can remain blocked forever even after the configured crash window has elapsed, creating a persistent denial-of-service condition against supervised agents and undermining the stated recovery semantics.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The skill metadata claims non-bypassable enforcement of timeouts, circuit breakers, audit logging, and crash-loop protection, but this file only implements timeout wrapping plus in-memory statistics. That mismatch can create a false sense of security for operators or downstream code, causing them to rely on protections that are not actually present and leaving tool execution insufficiently supervised.

Vague Triggers

Medium

Confidence: 78% confidence
Finding: The trigger phrase is broad and may activate the skill in loosely related contexts involving supervision, timeouts, circuit breakers, or audit protection. Over-broad activation can cause unintended loading of a skill with file persistence and control-plane behaviors, increasing the chance of unnecessary access, confusing agent behavior, or accidental reliance on optional enforcement mechanisms.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.