AgentGuard

• Outcome: Review
• Latest audit: Jul 10, 2026 · 2:53 AM UTC
• Version: 1.0.0

Overview

AgentGuard appears defensive, but it needs review because it monitors and stores sensitive agent activity while its scope and external-sharing disclosures are inconsistent.

Install only if you intentionally want an agent activity monitor. Before running it, restrict watched directories, keep alert/report channels console-only unless you explicitly want external delivery, review what is stored under ~/.agentguard, shorten retention if needed, and verify local file permissions for logs and alerts.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The 'summary' CLI path is not read-only as its name implies: it starts live monitoring of configured directories and collects events for two seconds before returning a report. That creates side effects and privacy exposure, especially because monitored paths include user directories and sensitive-file pattern detection, so a user asking for a passive summary may unknowingly trigger surveillance.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The README promotes comprehensive monitoring, logging of external communications, and activity reporting, but it does not clearly warn users about the privacy implications of collecting potentially sensitive behavioral and communication data. Even though the document later claims data is local and secrets are hashed, users are not given upfront notice about scope, consent, retention, or the risk of capturing sensitive metadata and content during monitoring.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The skill advertises file monitoring as a 'continuous background monitoring' trigger without clearly defining activation boundaries, consent, or scope. In an agent ecosystem, this can enable unexpectedly persistent surveillance behavior and broaden data collection beyond what a user reasonably expects.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The communication logging feature states that all external communications are logged for audit trails, but the skill does not present a prominent warning about the privacy and retention implications of storing monitored activity. This can lead to collection of sensitive metadata or message content without sufficiently informed user awareness, increasing privacy and compliance risk.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The code persists full alert records, including arbitrary `details`, to `~/.agentguard/alerts/*.json` without any explicit user notice, consent flow, retention control, or file-permission hardening. Because alerts may contain sensitive security telemetry, incident details, or identifiers, this can create unintended local data exposure if the host is shared, backed up, or otherwise accessible.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The logger writes structured activity details, including file paths, URLs, destinations, and arbitrary caller-supplied details, to local JSONL files under the user's home directory. Because sanitization is regex-based and incomplete, secrets, internal paths, tokens embedded in uncommon formats, or sensitive operational metadata can be persisted to disk where other local processes, backups, or forensic collection may later expose them.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: Starting monitoring immediately on configured user directories without a user-facing privacy warning can cause unnoticed collection of file activity, including accesses involving sensitive paths. In an agent skill context, silent observation of workspace and home-directory data is risky because users may not realize the scope of monitoring or that sensitive filenames and metadata are being recorded.

Missing User Warnings

Low

• Confidence: 83% confidence
• Finding: The code creates persistent configuration and log directories under the user's home directory automatically, without explicit disclosure or consent. While not directly exfiltrating data, this establishes hidden persistence for monitoring artifacts and can retain sensitive operational metadata longer than the user expects.

Session Persistence

Medium

• Category: Rogue Agent

Content

## 🎯 Key Features

### 📁 File Access Monitoring
- Tracks all file read/write operations
- Detects access to sensitive files (.env, credentials, secrets)
- Identifies bulk read patterns that may indicate data exfiltration

• Confidence: 83% confidence
• Finding: write operations - Detects access to sensitive files (.env, credentials, secrets) - Identifies bulk read patterns that may indicate data exfiltration ### 🌐 API Call Detection - Monitors all outboun

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.