Agent-to-Owner File Bridge

• Outcome: Review
• Latest audit: Jul 10, 2026 · 3:18 AM UTC
• Version: 3.0.2

Overview

This is a disclosed file-sharing bridge, but its autonomous mode can run external server code and expose a public tunnel, so users should review it carefully before installing.

Install only if you specifically need agent-to-owner file sharing. Prefer a server you control, review server.py before autonomous mode, approve each exact file and destination, avoid sensitive data, keep API keys out of URLs when possible, close tunnels promptly, and delete or rotate temporary keys after use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The skill is presented as a file-sharing/upload bridge, but its documented API also exposes listing and deletion operations. In an agent context, broader data-management capabilities increase the chance an agent could enumerate prior uploads or delete content beyond the single file the user intended to share, especially if the same API key is reused across sessions or files.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The skill manifest frames the capability as uploading/sharing files to the owner, but the documented API also exposes list and delete operations over previously uploaded content. This expands the operational scope beyond the declared purpose, increasing the chance an agent will access or modify remote state the user did not explicitly request.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The instructions tell the agent to self-host a server in its workspace and expose it through a zero-auth public tunnel if no server is provided. That creates a publicly reachable service from the agent environment, which can expose uploaded files, increase attack surface, and enable unintended remote access paths not necessary for simple owner file sharing.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The document presents the bridge as secure while simultaneously directing use of a zero-auth free tunnel. This is materially misleading because unauthenticated public exposure undermines confidentiality and access control, making sensitive file-sharing workflows more dangerous in practice.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The trigger language is very broad ('upload this file', 'share this with me', 'send me the output', 'export results') and could activate in many ordinary conversations. In an autonomous agent environment, that raises the risk of the skill being invoked for sensitive workspace artifacts without sufficiently narrow scoping or repeated confirmation about exactly which file will be exposed externally.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger for self-hosting is broad: whenever the agent lacks a URL or API key, it is instructed to ask whether it should host the bridge itself. In context, this encourages powerful environment-changing behavior without narrowly defining when it is appropriate, increasing the risk of unnecessary server deployment and exposure.

Natural-Language Policy Violations

High

• Confidence: 98% confidence
• Finding: The instructions direct the agent to expose the hosted bridge using a zero-auth public tunnel, with no meaningful security justification and only an expiry warning. In a file-sharing skill, this makes the context more dangerous because the likely payloads are user outputs and workspace artifacts that may contain sensitive data, and anyone with the tunnel URL may access them.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.