Security audit

api2cli

Security checks across malware telemetry and agentic risk

Overview

This developer skill does what it claims, but it gives an agent broad install, linking, publishing, and deletion authority without enough confirmation gates.

Review this carefully before installing. Use it only if you are comfortable with an agent installing developer tools, linking executables and skills into your local environment, storing API tokens, and publishing code or skills publicly. Require explicit approval before any install, symlink, delete, force-push, repository creation, npm publish, or registry publish step, and inspect generated files for secrets before making anything public.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (8)

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill instructs publishing generated code and skills to public platforms without an explicit warning that repository contents, embedded secrets, internal endpoints, or proprietary logic may become public. In a code-generation and packaging workflow, this omission increases the risk of accidental data exposure because users may follow publish steps without a deliberate disclosure checkpoint.

Missing User Warnings

Medium

Confidence: 78% confidence
Finding: The `install` command explicitly clones code, builds it, links it into PATH, and symlinks a skill into agent directories, but the documentation does not prominently warn users that this modifies execution paths and agent-integrated locations. In an agent-skill context, installing from a GitHub repo or registry entry can introduce untrusted code and persistence-like behavior, increasing the risk of inadvertent execution of malicious wrappers or skills.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The file provides a copy-paste setup block that installs software globally, installs a skill from a registry, and links it into the agent's discovery path, but it does not warn that these commands modify the host environment. In an agent-skill context, encouraging blind execution of system-changing commands increases the risk of unintended package installation, persistence, and trust of unreviewed code.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill instructs the agent to create a public GitHub repository and push local code without requiring an explicit confirmation that the user understands the code will be published publicly. In this context, the repository contents originate from a local working directory and may include sensitive files, proprietary code, or history that should not leave the machine, so automatic publication materially increases the risk of data exposure.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The instructions create a GitHub repository with `--public` but do not explicitly warn the user that the code, history, and included files will become publicly accessible. In a skill that automates CLI generation and publishing, users may follow these steps mechanically and accidentally expose proprietary code, credentials, or internal documentation if the repo has not been sanitized first.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The registry publication step sends repository metadata to an external service without clearly warning the user that they are transmitting data outside GitHub/local tooling. In this skill context, the omission is more concerning because the workflow is specifically designed to publish and distribute artifacts, so users may not realize they are enrolling their project in a third-party registry.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The template includes a destructive `delete` command with no confirmation prompt, dry-run mode, or warning guidance. In a CLI/skill generator context, this pattern is likely to be propagated into many generated tools, increasing the chance of accidental or scripted deletion of remote resources with little user friction.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill instructs the agent to create directories and symlink files into user home agent-skill locations, which modifies local configuration and persists beyond the current task. Because this is framed as a normal completion step and lacks an explicit consent/confirmation requirement, an agent could silently alter a user's environment and influence future agent behavior.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.