Csb Agent Eval

• Outcome: Review
• Latest audit: Jul 19, 2026 · 10:57 AM UTC
• Version: 0.2.0

Overview

This is a coherent agent-evaluation skill, but it sends personal/contextual test prompts to configured local and public agents and saves response artifacts without enough privacy scoping or retention guidance.

Review before installing or running. Use it only against agents you are authorized to test, check config/agents.json for public endpoints, avoid production or sensitive agents unless the operator consents, and treat eval-results/ as potentially sensitive because it can contain prompts and agent response excerpts. Do not enable any external Feishu/cron delivery unless you have reviewed exactly what will be sent and where.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (9)

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The README explicitly states that scheduled evaluation results are pushed to Feishu, but provides no warning, consent model, scoping, or data-handling guidance. If evaluation outputs include prompts, model responses, identifiers, or internal benchmark content, this creates a real risk of unintended external data transmission to a third-party service.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The documentation instructs users to run scripts that probe agents, send evaluation prompts, and persist results to disk, but it does not clearly disclose those side effects or the privacy/security implications. In this context, the skill evaluates local and remote agents and stores transcripts/reports, so users may unintentionally transmit sensitive prompts or retain sensitive outputs without informed consent or handling guidance.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The script persists evaluation history to disk and includes per-test agent responses, some of which are prompted to reveal user-specific information such as name, city, medical context, preferences, and relationship data. Storing this without notice, minimization, consent, or retention controls creates a privacy leak and a durable source of sensitive data exposure if the host, repo, backups, or logs are accessed.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script sends prompts and receives agent responses over the network, but it does not clearly disclose that evaluation content is being transmitted to remote endpoints and later reused in reports. In an evaluation context, those prompts and responses may contain sensitive test content, agent identifiers, or user-supplied evaluator labels, so the lack of explicit notice and consent creates a real privacy and data-handling risk.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script persists detailed evaluation artifacts, including response previews, multi-turn interaction metadata, and historical results, to local files without an explicit user-facing warning or retention controls. If the evaluated agents echo secrets, internal prompts, or personal data, that information will be written to disk and remain accessible to other local users, backups, or later processes.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The evaluation suite deliberately probes for recall of highly specific personal data and interpersonal context, including name, city, interests, recent activities, relationship roles, and possible medical information, then stores resulting responses in history. This combines privacy elicitation with durable retention, increasing the chance of unauthorized disclosure, model-memory testing against real PII, and downstream leakage through files, backups, or source control.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"start": "node server.js"
  },
  "dependencies": {
    "express": "^4.18.2",
    "node-fetch": "^2.7.0"
  }
}

• Confidence: 93% confidence
• Finding: "express": "^4.18.2"

Unpinned Dependencies

Low

• Category: Supply Chain

Content

},
  "dependencies": {
    "express": "^4.18.2",
    "node-fetch": "^2.7.0"
  }
}

• Confidence: 92% confidence
• Finding: "node-fetch": "^2.7.0"

Known Vulnerable Dependency: express==4.18.2 — 2 advisory(ies): CVE-2024-43796 (express vulnerable to XSS via response.redirect()); CVE-2024-29041 (Express.js Open Redirect in malformed URLs)

Low

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: express==4.18.2

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: config/agents.json:3