Mac Multi User Agents

• Outcome: Review
• Latest audit: May 29, 2026 at 9:22 PM UTC
• Version:
  1.1.0

Overview

The skill is coherent and user-directed, but it provisions persistent macOS accounts while handling account passwords in a way that can expose them.

Install or run this only on a Mac you administer. Prefer non-admin agent accounts, render commands with placeholder passwords first, avoid dry-running with a real password, and rotate any password used through the environment or command line immediately after account creation.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence
• Finding: The skill clearly instructs execution of shell scripts that can create macOS users, verify shell state, and write rollout receipts, yet it declares no permissions. That mismatch is dangerous because it obscures the true capabilities of the skill from any permission-review or policy-enforcement layer, increasing the chance that administrative changes and file writes occur without explicit scrutiny.

VirusTotal

64/64 vendors flagged this skill as clean.