skill-standardization

• Outcome: Review
• Latest audit: Aug 4, 2026 · 5:25 AM UTC
• Version: 2.103.0

Overview

This appears to be a real skill-standardization tool, but it can automatically rewrite, move, back up, and delete skill files with weak user-control boundaries.

Review carefully before installing. Use this only on disposable or version-controlled skill directories, avoid running update/refactor/fix modes on directories containing secrets or unrelated user files, and prefer readonly/audit commands unless you are prepared for automated edits, moves, backups, and cleanup actions.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (29)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

try:
            with tempfile.NamedTemporaryFile(mode='w', suffix='.json', delete=False) as f:
                out = f.name
            result = subprocess.run(
                [sys.executable, str(checker), str(skill_dir), "--output", out],
                capture_output=True, text=True, timeout=30
            )

• Confidence: 92% confidence
• Finding: The updater spawns an external Python script (`permission_checker.py`) via `subprocess.run`, which creates an execution boundary to another file without any integrity check, explicit trust validation, or user confirmation at the call site. In a skill update/check tool, executing another local script is risky because compromise or replacement of that helper script turns a documentation/update workflow into arbitrary code execution with the current user's privileges.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill declares high sensitivity and describes capabilities including file writes, shell execution, network access, and environment access, yet the analyzer reports no explicit declared permissions. This mismatch weakens policy enforcement and user understanding, making it easier for a powerful skill to operate without clear guardrails or review.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The trigger section labels generic inspection requests as negative while the manifest lists similar phrases as positive triggers. This contradiction can cause the wrong skill to activate or suppress expected behavior, which is risky here because the skill has sensitive access and can drive file-modifying workflows.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The CLI advertises a dry-run mode, but the code still calls finalize() and run_cleanup() before checking dry_run, so it mutates state and deletes files even when the user expects a non-destructive preview. In a cleanup utility, this violates operator expectations and can cause irreversible loss of temporary or backup artifacts that may be needed for recovery or auditing.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: This module exposes generic read/write/patch primitives and a CLI that accepts arbitrary filesystem paths with no scope restriction, allowlist, or policy enforcement. In an agent skill context, that creates a powerful file-manipulation capability that can be abused to modify sensitive files, alter other skills, or persist changes outside the intended standardization workspace.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The read command can access any local file path and optionally copy its contents to any output path, effectively providing arbitrary local file read and relay functionality. In a skill environment, this broadens the capability from standardization review into potential data exfiltration of secrets, configs, tokens, or unrelated project files.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The module is presented as a path-auditing checker, but it also contains an automatic remediation function that writes to _meta.json and rewrites Python files under scripts/. In a security-sensitive auditing component, mixing inspection with mutation is dangerous because invoking the fixer on untrusted skills can alter repository contents unexpectedly and can introduce incorrect paths or corrupt code.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The docstring understates what the fixer does: the implementation does not just normalize declared data-directory variables, it rewrites files to a specific Path.home()/.workbuddy/skills/.standardization/... path. This mismatch can cause operators to trust a limited-scope fix while the code performs broader, opinionated file modifications, increasing the risk of unintended persistence, broken portability, and silent configuration tampering.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: `fix_artifact_paths` goes well beyond documentation standardization and performs destructive filesystem actions: it deletes files matching broad patterns, moves user files based on inferred violations, and rewrites references across the skill tree. In a fixer invoked on untrusted or misclassified input, this can cause irreversible data loss or unintended modification of source and content files without a narrow allowlist or user approval.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: `fix_create_permissions_md` reloads modules from `sys.modules` and imports `PermissionChecker` from the runtime environment, which makes behavior depend on ambient import state rather than a fixed internal dependency. In a plugin-like environment, that expands attack surface and can execute unexpected code during what should be a deterministic documentation-generation step.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: `fix_missing_data_dir` injects new constants and import statements into Python and shell scripts, modifying executable source code rather than only standardizing metadata or docs. Automated code rewriting of this kind can silently change runtime behavior, break scripts, or introduce unsafe path handling across arbitrary skills.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: This updater has a broader capability than expected for a standardization/update engine because it executes an external Python program as part of routine processing. That capability expansion increases the attack surface: a tampered checker, path confusion, or unsafe deployment environment can convert a passive audit/update step into code execution.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The skill is written to force Chinese-language interaction without user choice. Constraining language can undermine informed consent and review, especially for a high-permission skill, because users may not fully understand what actions will be taken or what reports mean.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The operational rules forbid asking the user for clarification and require a fixed-format mode disclosure in Chinese. For a skill that can audit, update, refactor, and write files, preventing clarification increases the chance of unintended or overly broad actions and reduces user control.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger list contains broad phrases such as '审计 skill', '创建新技能', and '更新 skill' that overlap with ordinary user requests, making unintended or excessive invocation more likely. Because this skill performs auditing, creation, refactoring, and permission/data-directory related checks, accidental activation could cause the agent to enter a powerful workflow when the user did not explicitly request this specific skill.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The refactor flow archives the entire skill directory into a ZIP backup without a prominent pre-operation warning or content minimization. If the skill directory contains secrets, local datasets, tokens, or unrelated user files, the tool silently duplicates that data into backup storage, increasing exposure and retention risk.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The update path similarly creates a full ZIP backup of the skill directory without clearly warning that user content will be copied. This can unintentionally retain sensitive material in backup artifacts and expand the blast radius if those archives are later shared, indexed, or left on disk.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The code deletes files immediately with `os.remove` during automated fixing, without an approval gate at the operation site. In a remediation tool processing imperfect findings, that creates a direct risk of unintended destructive changes and permanent loss of user data.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The fixer moves files and changes on-disk layout automatically, again without explicit confirmation. Even with backups in some paths, these moves can break code, references, packaging, or user expectations when the inferred destination is wrong.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: `fix_license_compliance` deletes LICENSE files from the skill root and `scripts/` automatically. Besides data loss, removing license files can create legal/compliance issues and is especially risky for a tool whose role is standardization rather than destructive repository cleanup.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The fixer relocates or removes README content without prior approval, altering repository structure and potentially discarding project guidance users rely on. In an automated audit/fix workflow, such content moves can break links and create silent documentation loss.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The creator performs substantial filesystem writes and directory creation based on user-controlled arguments without a dry-run, confirmation step, or clear safety interlock. While it checks whether the top-level skill directory exists, it still creates multiple sibling directories and files under the selected base path, so misuse or operator error could unexpectedly modify the repository or an unintended location.

Missing User Warnings

Medium

• Confidence: 72% confidence
• Finding: The refactor flow performs multiple destructive or integrity-affecting operations—file moves, code rewrites, permission-doc injection, version updates, and progress updates—without an interactive confirmation gate. In a tool that operates on a user-supplied skill directory, this increases the chance of accidental modification of the wrong target or unintended repository changes, especially because the behavior goes beyond simple file normalization.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The subprocess execution occurs silently from the user's perspective: the updater automatically runs another script during update flow without a clear opt-in or confirmation at the execution point. In tooling that modifies files and analyzes permissions, undisclosed execution of helper code reduces transparency and can hide privileged actions or unexpected side effects.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The rollback operation restores a file directly to the recorded original path using metadata from manifests, with no confirmation prompt, path validation, or dry-run safeguard. In a file-management skill, this increases the chance of accidental or unsafe overwrites, especially if manifest data is stale or tampered with, leading to integrity loss of arbitrary files reachable by the executing user.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/skill_audit/__init__.py:82