Security audit

Agent Registry

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed local agent registry with an automatic local prompt-search hook and opt-in telemetry, with no artifact-backed evidence of hidden exfiltration or destructive default behavior.

Install this only if you want a persistent hook that locally checks every prompt against your agent registry and may add matching-agent suggestions to context. Leave AGENT_REGISTRY_TELEMETRY unset, or set DO_NOT_TRACK/AGENT_REGISTRY_NO_TELEMETRY, if you do not want usage telemetry sent. Use the default copy migration first; only run --move if you intentionally want source agent files relocated.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 82% confidence
Finding: The skill declares no permissions while its documented behavior and hook configuration invoke external commands, access environment variables, and operate on local files and potentially the network. This creates a trust and review gap: users and the host system cannot accurately assess the skill's capabilities before installation or execution.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The skill is presented as a mandatory discovery helper, but the documented behavior extends to prompt hooks, agent migration, filesystem modification, installation actions, and referenced external telemetry. That mismatch is dangerous because users may authorize or rely on the skill under a narrower trust model, while it actually performs broader and more sensitive operations on every prompt and across agent directories.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: This module makes outbound requests to a third-party telemetry endpoint, which is outside the core agent-discovery function described by the skill metadata. Even though telemetry is opt-in and the payload is limited, undisclosed network egress from a skill increases supply-chain and privacy risk because usage metadata and event names can still reveal behavior patterns and create a covert communication channel.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The code performs remote usage tracking that is not disclosed in the manifest, creating a transparency and consent problem in a component that users are instructed to use mandatorily. In this context, hidden telemetry is more dangerous because the skill is positioned as a required agent-loading mechanism, so its network behavior affects many workflows and could expose operational metadata at scale.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The README documents a destructive `--move` migration mode but does not provide a strong, explicit warning about irreversible data loss, rollback limitations, or the need to verify backups before use. In this skill’s context, the command operates on users’ agent files under `~/.claude/agents/`, so unclear documentation can realistically lead to accidental loss or displacement of locally maintained agent definitions.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: tests/cli.test.js:13

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: lib/telemetry.js:34