Security audit

factor-prune

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed local factor-pruning workflow that reads bundled factor spreadsheets, calls a QuantAll MCP service, and writes local analysis outputs.

Install only if you intend to work with QuantAll factor data. Review the local outputs/state it creates, avoid pointing --mcp-url at untrusted remote services, and start QuantAll manually so duplicate instances are not created.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill documents capabilities to read and write local files and connect to a network service (QuantAll), but it declares no permissions or capability boundaries. That mismatch can cause the agent platform or reviewer to underestimate the skill’s access and allow execution in contexts where filesystem or network use was not expected.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: The manifest frames the skill as a pruning utility, but the document includes broader analysis, visualization, probing, and startup-related tooling. Description/behavior mismatch is dangerous because it defeats informed consent and policy gating: a caller may invoke what appears to be a limited data-selection skill while actually enabling additional data processing or operational behaviors.

Description-Behavior Mismatch

Medium

Confidence: 87% confidence
Finding: The skill claims it only outputs a pruned factor list, yet the same package documents analysis and visualization utilities that go beyond that boundary. This inconsistency increases the chance of unintended data handling and makes security review, sandboxing, and user expectation management less reliable.

Context-Inappropriate Capability

High

Confidence: 93% confidence
Finding: The documentation says the skill should connect to an existing QuantAll instance and avoid managing processes, but it also retains a startup entrypoint. Keeping process-management capability in a skill that claims not to manage processes creates a hidden operational action surface and can lead to unauthorized service start, duplicate instances, lock contention, or disruption of the target environment.

Intent-Code Divergence

Medium

Confidence: 86% confidence
Finding: The document repeatedly states the skill 'only does one thing,' but later sections include extra analysis tooling and a retained startup component. Security decisions based on that narrow claim may therefore be wrong, resulting in over-trust and under-scoping of review or sandbox controls.

Vague Triggers

Medium

Confidence: 78% confidence
Finding: The trigger conditions are defined by a broad keyword list without meaningful exclusions or contextual checks. That can cause the skill to activate in unintended conversations, exposing local files or network actions in contexts where pruning was not actually requested.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The script connects to an external QuantAll tool, executes multiple tool calls, and then writes the full returned results to a local state file without any confirmation, minimization, or sanitization. In this skill context, the returned payloads may contain proprietary factor expressions, analytical outputs, or unexpectedly large/sensitive data, so automatic persistence increases the risk of data leakage and uncontrolled retention.

VirusTotal

58/58 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.