GenAI Security Gateway

• Outcome: Review
• Latest audit: Jul 31, 2026 · 5:43 PM UTC
• Version: 0.1.3

Overview

This skill is a disclosed local prompt-auditing firewall; its network/model-download and MCP behavior are mostly documented and proportionate, with install-time caution needed.

Before installing, review and preferably pin the Python dependencies, and decide whether first-run model download from Hugging Face is acceptable. For offline or sensitive deployments, pre-cache or provide a local model path and set GENAI_SECURITY_LOCAL_ONLY=1. Treat the output as one preflight signal, not a complete security boundary.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill declares no permissions while the documented behavior clearly implies environment variable access, file reads, and possible network access for model downloads. This creates a transparency and trust gap: a caller may assume the skill is fully local and low-privilege, but invoking it can still touch local files, process environment configuration, and potentially contact external infrastructure.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: The documented purpose says the skill is a local-first prompt firewall, but the file also describes extra behavior such as a second MCP tool, configurable external model/template loading, and resource-abuse blocking not reflected in the main description. This mismatch can mislead operators about the attack surface and data-flow boundaries, especially because model loading may trigger network access despite the local-first framing.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The semantic detector loads a SentenceTransformer model with network access enabled by default unless GENAI_SECURITY_LOCAL_ONLY is explicitly set. In a security gateway advertised as local-first, this can cause unintended outbound requests, metadata leakage, startup hangs, and nondeterministic behavior during security checks.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The skill metadata and description claim the server only audits prompts and returns PASS/BLOCK-style security decisions, but the code also exposes an optimization/transformation tool. In a security gateway context, undocumented prompt transformation expands the trust boundary and can let callers use the skill for behavior not disclosed to operators, potentially rewriting prompts in ways that bypass review, alter meaning, or create hidden data-handling paths.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The docstring states the optimization function is only a reserved future stub, but the function actually invokes a live implementation. This mismatch is dangerous because reviewers, users, and policy engines may treat the endpoint as inert while it performs real prompt processing, enabling hidden functionality and undermining security review assumptions in a component marketed as a prompt firewall.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The skill enables implicit invocation with no trigger constraints, exclusion rules, or scope limits. For a security-sensitive skill that audits prompts before tool use, this can cause the firewall to be auto-invoked in unintended contexts, creating prompt-routing surprises, denial-of-service style friction, or opportunities for attackers to influence when and how the audit layer is applied or bypassed.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
sentence-transformers
mcp[cli]

• Confidence: 96% confidence
• Finding: The dependency on numpy is unpinned, which makes builds non-reproducible and allows future installs to silently pull different versions, including versions with security regressions or incompatible behavior. In a security gateway skill, supply-chain integrity matters more than usual because the package participates in prompt inspection and policy enforcement, so unexpected dependency changes could weaken protections or introduce exploitable code paths.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
sentence-transformers
mcp[cli]

• Confidence: 97% confidence
• Finding: The dependency on sentence-transformers is unpinned, creating a supply-chain and reproducibility risk because installations may resolve to different transitive dependency sets over time. This is especially relevant for a prompt firewall component, where model-loading behavior and transitive packages can materially affect detection quality, stability, or security exposure.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: CLAWHUB_SUBMISSION.md:52

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: README.md:20

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: references/security-policy.md:5

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: SKILL.md:17