Security audit

diagram-generator

Security checks across malware telemetry and agentic risk

Overview

This skill is a diagram-generation helper that clearly centers on creating or editing diagram files, with no evidence of hidden data access, exfiltration, or destructive behavior.

Before installing, understand that this skill is meant to configure and use an external MCP diagram generator, which can create configuration files, output directories, and diagram files, including at custom paths you provide. Review the target path before generation, especially when editing existing files or using a non-default output location.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The activation guidance is broad enough to route many ordinary requests about drawing, revising, or exporting diagrams into a file-writing skill without first making the side effects explicit. In this skill’s context, that increases the chance of unintended tool invocation and disk writes, especially because the workflow supports custom filenames and output paths.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill does not prominently warn that using it can create directories and write files to disk, including at user-specified output paths. That omission weakens informed consent and makes accidental persistence, overwrites, or placement of files in sensitive or unexpected locations more likely.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.