Security audit

genesis-ouroboros

Security checks across malware telemetry and agentic risk

Overview

This skill is coherent for building a self-evolving agent scaffold, but its default automatic lesson persistence deserves user review before installation.

Install only if you want generated agents to evolve by writing lessons and scripts over time. For sensitive projects, change distill_mode to confirm before use and review any lesson or script changes for secrets, private context, or unwanted behavior changes.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The activation metadata uses broad natural-language triggers for creating or scaffolding a new agent, which can cause the skill to activate in contexts the user did not clearly intend. In a code-generating skill that can create persistent project artifacts, overbroad invocation increases the chance of unintended scaffold generation and downstream file changes.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The workflow allows execution whenever a user merely describes a new agent in natural language, without strong scope boundaries or exclusion criteria. Because this skill can initiate broad planning and artifact generation, ambiguous activation can lead to unintended use, prompt hijacking by loosely related requests, or accidental creation of persistent content.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The Chinese activation path mirrors the same issue: broad natural-language triggers without clear exclusions make the skill easy to invoke unintentionally. Multilingual broad triggers widen the reachable surface area and make accidental or adversarial activation more likely across more user inputs.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill defaults to `distill_mode=auto`, instructing the agent to write distilled experience into files after sessions without an upfront warning that persistent modifications will occur. Silent persistence is risky because user content, internal reasoning summaries, or sensitive project context may be recorded unexpectedly and retained beyond the current interaction.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The Chinese version preserves the same unsafe default behavior while omitting an upfront warning about automatic persistence. This creates inconsistent user awareness across locales and can lead Chinese-speaking users to have data written to project files without meaningful informed consent.

Ssd 3

Medium

Confidence: 97% confidence
Finding: Automatically retaining and writing information from every interaction into persistent skill artifacts without user approval creates a data retention and privacy risk. In the context of an agent-construction skill, sessions may include API details, internal project context, user requirements, or sensitive operational patterns that should not be silently memorialized into repository files.

Ssd 3

Medium

Confidence: 97% confidence
Finding: The Chinese instruction similarly directs automatic persistence of learned content from each conversation, again without requiring approval by default. Because the skill is designed to evolve itself through accumulated lessons, the context amplifies the danger: it institutionalizes broad retention as a core behavior rather than an exceptional action.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.