Security audit

File Writer

Security checks across malware telemetry and agentic risk

Overview

This scratch file writer is not clearly malicious, but it asks the agent to use shell commands for file operations in a way that is broader than its safe-file-writing promise.

Install only if you are comfortable letting the agent create, overwrite, append, and back up text files in the scratch directory. Use explicit relative paths, review every confirmation carefully, and avoid approving or copying shell fallback commands unless you have checked the exact path and content. Static scan was clean and VirusTotal was pending, but the shell-command handling warrants Review before use.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The skill explicitly instructs use of an exec tool to run 'mkdir -p' and provides shell fallback commands for the user to execute, even though the skill is advertised as not for executing code. This expands the skill from constrained file writing into command construction/execution, creating command-injection and policy-bypass risk if path handling is imperfect or if an agent follows the shell fallback literally.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The documentation broadens behavior beyond a narrowly scoped safe file-writer by referencing shell-based fallback commands and a bundled Bash backup script. In security-sensitive agent environments, embedding shell fallbacks normalizes arbitrary command execution paths and increases the chance an agent or user is steered into unsafe filesystem actions outside the intended constrained tool interface.

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: The reference text explicitly instructs the agent to run `mkdir -p`, which expands the skill from file-writing into command execution. Even though the command itself is simple, introducing shell execution in a supposedly write-only, scratch-scoped skill creates unnecessary capability creep and increases the chance of misuse, prompt-injection abuse, or unsafe path handling in a later implementation.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: Introducing shell-command execution is not justified for a scratch-only file writer and contradicts the stated restriction that the skill is not for executing code. This is made more dangerous by the skill context: users expect a narrowly constrained file utility, so hidden or documented command execution broadens the attack surface and may let adversarial prompts pivot the agent into behavior outside its declared scope.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The trigger phrase 'update the script with the new feature' is broad enough to match ordinary conversation and may cause the skill to activate unexpectedly. In context, unintended invocation is more dangerous because this skill can modify files and includes risky fallback behaviors, so accidental activation could lead to unwanted writes or prompts to run shell commands.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.