agent-skills-setup

• Outcome: Review
• Latest audit: Aug 17, 2026 · 5:52 AM UTC
• Version: 0.8.18

Overview

This looks like a local migration tool, but it includes under-scoped paths for persistent agent configuration and plugin/session-related migration behavior that users should review before installing.

Install only if you specifically need local agent-context migration and are prepared to review the generated plan, resolved paths, and diffs before using `--yes`. Avoid using plugin or handoff/session object migration unless the package is corrected and you can verify exactly what will be copied. Treat MCP changes as sensitive because they can change what tools an agent can call.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 97% confidence
• Finding: The skill metadata declares compatibility and mentions powerful operations, but it does not provide an explicit permissions declaration despite requiring environment lookup, filesystem access, shell execution, and write-capable migration flows. In an agent system, this under-scopes the trust boundary and can cause reviewers or policy enforcement to miss that the skill can read local state, execute bundled scripts, and modify files.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: The description says the skill is for planning, migrating, and inspecting skills/instructions/MCP, but the body authorizes a much broader set of behaviors: snapshot bundles, restore flows, doctor diagnostics, additional object types, plugin/package handling, and agent/hooks surfaces. This mismatch is dangerous because users and automated controls may approve the skill for a narrower use case while it can process and write substantially more sensitive local state than advertised.

Context-Inappropriate Capability

High

• Confidence: 94% confidence
• Finding: The registry explicitly defines internet-based candidate discovery sources and automated weekly discovery behavior, which contradicts the skill's stated local-only, network-forbidden contract. Even if this file is only metadata, embedding network-oriented discovery logic broadens the expected behavior of downstream tooling and can normalize or trigger unauthorized outbound access.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: Declaring a cloud-account detection probe introduces an online or account-integrated capability that is unnecessary for a local setup skill and conflicts with the no-network restriction. This increases the chance that implementations perform unexpected authentication checks, account enumeration, or outbound requests under the guise of detection.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The registry covers many artifact classes beyond skills, instructions, and MCP, including hooks, cron, automations, agents, plugins, memory, trust, schedules, and workflows. This scope expansion increases the attack surface because the skill may inventory, transform, or potentially write sensitive or executable agent configuration types not justified by its stated purpose.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The file claims to be a migration core for instructions, skills, and MCP, but apply_plan also migrates plugins and handoff/session artifacts. That hidden scope expansion increases the skill's authority to copy arbitrary package contents and session data beyond the declared purpose, creating a supply-chain and data-exfiltration risk if users approve the skill based on incomplete capability disclosure.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The handoff migration path reads session files, parses or wraps their contents, and augments them with Git provenance before writing them out. Session/handoff artifacts can contain sensitive conversation context, file paths, code, or tokens, so copying and enriching them without explicit scope justification or dedicated secret scrubbing can leak sensitive local state into new targets.

Missing User Warnings

Medium

• Confidence: 81% confidence
• Finding: resolve_path honors override_env and uses an environment variable to redirect migration boundaries and target paths, but this redirection is not surfaced to the user in a clearly reviewable way at the point of decision. In an agent context, environment-controlled path selection can silently broaden what filesystem locations are read from or written to, undermining user expectations about where migration operates.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

{
                "scope": "user",
                "storage": "config-subobject",
                "path": "~/.codex/config.toml",
                "format": "toml:mcp_servers",
                "policy": "manual-template"
              },

• Confidence: 83% confidence
• Finding: ~/.codex/config.toml

MCP Config Access

High

• Category: Agent Snooping

Content

{
                "scope": "user",
                "storage": "file",
                "path": "~/.gemini/mcp.json",
                "format": "json:mcpServers",
                "policy": "profile-version-adapter"
              },

• Confidence: 88% confidence
• Finding: .gemini/mcp.json

MCP Config Access

High

• Category: Agent Snooping

Content

{
                "scope": "project",
                "storage": "file",
                "path": ".gemini/mcp.json",
                "format": "json:mcpServers",
                "policy": "profile-version-adapter"
              }

• Confidence: 88% confidence
• Finding: .gemini/mcp.json

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.