Security audit

Praesidia

Security checks across malware telemetry and agentic risk

Overview

The skill is coherent and not malicious, but it needs review because it can change live agent guardrails and send validation text to Praesidia without clear confirmation or privacy prompts.

Install only if you intend your assistant to use a Praesidia account for agent verification and guardrail management. Use a scoped API key, require manual confirmation before applying or changing guardrails on production agents, and avoid sending confidential, regulated, or secret-containing text for validation unless sharing it with Praesidia is acceptable.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The skill instructs the agent to derive or retrieve an organization ID from user profile/context and then use it for organization-scoped guardrail queries. That expands access from simple agent verification into potentially sensitive org-level data access, and risks confused-deputy behavior if the agent infers or reuses context without explicit user confirmation and authorization checks.

Context-Inappropriate Capability

Medium

Confidence: 86% confidence
Finding: The skill supports listing all agents the user has access to, including team/org agents, which broadens data exposure beyond narrow verification or public discovery use cases. In multi-tenant or team environments, this can reveal internal inventory, names, statuses, and capabilities that may be sensitive and unnecessary for the immediate task.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The README explicitly instructs the assistant to apply guardrails via authenticated POST requests that can block, redact, replace, retry, or escalate content, but it does not require an explicit confirmation or warning before making these configuration changes. In an agent skill context, this can lead to unintended security policy changes or service disruption if the assistant acts on ambiguous user intent or summarizes actions as informational rather than mutating.

Vague Triggers

Medium

Confidence: 76% confidence
Finding: The description uses broad invocation triggers like security policies, content moderation, and general safety questions, which can cause the skill to activate in conversations outside its intended scope. Over-broad activation increases the chance that unrelated user content is sent to Praesidia APIs or that the agent takes external actions when a narrower, local response would suffice.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The guardrail validation flow tells the agent to submit user-provided content to an external endpoint but does not clearly warn that the content leaves the local environment. Users may unknowingly send sensitive prompts, PII, secrets, or regulated data to a third-party service under the guise of a safety check.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill allows applying guardrails via a POST request that changes live agent configuration, yet it does not require a clear warning or confirmation about operational impact. Misapplied policies can block traffic, redact outputs, or alter production behavior unexpectedly, creating availability, integrity, and business-process risks.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: README.md:566