Security audit

Praesidia

Security checks across malware telemetry and agentic risk

Overview

This is a coherent Praesidia integration, but it can send sensitive content to a third-party API and make persistent guardrail changes without clear confirmation requirements.

Review before using with production Praesidia accounts. Use a least-privilege API key, keep PRAESIDIA_API_URL pointed only at a trusted endpoint, require the assistant to show and confirm any guardrail change before it is applied, and avoid validating confidential, regulated, or secret-bearing content unless Praesidia's data handling is acceptable.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The skill explicitly tells the agent to derive an organization ID from user profile or context and then use it to query organization-scoped guardrail data. That expands access from simple verification/discovery into potentially sensitive tenant-scoped administration data, and can cause cross-tenant or over-broad access attempts if identity and authorization are not made explicit to the user.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill instructs assistants to apply guardrails that can BLOCK, REDACT, REPLACE, RETRY, or ESCALATE content, but it does not require an explicit user warning or confirmation before making potentially destructive or behavior-changing changes. In a security/compliance skill, silent modification or blocking can cause user confusion, break workflows, or enforce policies the user did not knowingly approve.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The content validation flow tells the assistant to send arbitrary message content to the Praesidia API for guardrail checking, but it does not warn that user-provided text may contain sensitive or regulated data. This creates a privacy and compliance risk because users may unknowingly transmit PII, credentials, or confidential business content to a third-party service.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The manifest uses very broad trigger phrases like security policies, content moderation, and 'is this agent safe?', which can cause the skill to activate in contexts broader than the user intended. Because the skill can also perform state-changing and external API actions, over-invocation increases the chance of unintended data sharing or configuration changes.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill includes a POST request that creates or enables guardrails on an agent but does not require an explicit warning or confirmation that agent configuration will be modified. That creates a risk of unauthorized or accidental state changes, especially if the skill is auto-invoked from broad prompts or ambiguous user requests.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The content-validation flow instructs sending user-provided content to an external Praesidia API without a privacy notice or consent step. If users paste sensitive prompts, PII, regulated data, or proprietary text, the skill could exfiltrate that content to a third party unexpectedly.

VirusTotal

61/61 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: README.md:566