3232

• Outcome: Review
• Latest audit: May 29, 2026 · 9:25 PM UTC
• Version: 1.0.0

Overview

The skill is a coherent guide for a skills-management CLI, but it encourages automatic approval of installs, updates, removals, and publishing actions that can affect multiple AI tools.

Review this carefully before installing. Use it only if you trust the @tiktok-fe/skills npm package and the skill sources it installs from. Prefer project scope, specify exact agents with --agents, use --list or list commands before updates, and do not allow -y or --force for remove, clean, update, publish, unpublish, or overwrite actions unless you have approved the exact target and scope.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The invocation description is broad enough to trigger this skill for generic requests about finding, installing, updating, or managing skills across multiple agents, even when the user may not specifically want the @tiktok-fe/skills CLI. That increases the chance an agent will invoke this skill in the wrong context and perform package-management actions the user did not explicitly authorize.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill documents destructive commands such as remove, clean, unpublish, and update with force/auto-confirm flags, but does not pair them with explicit warnings about deleting installed skills, modifying environments, or requiring user confirmation. In an agent setting, this omission makes accidental destructive execution more likely because the examples normalize irreversible or high-impact operations.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The guidance tells AI agents to broadly use `-y` or `--force` to skip confirmations, without limiting this to explicitly user-approved, low-risk operations. In an agent context, this increases the chance of unattended installs, removals, updates, or cleanup actions proceeding without human review, which can amplify mistakes or prompt-injection-driven actions.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The command explicitly supports `--force` to overwrite existing skills without prompt, yet the documentation does not present a strong warning about replacing local files or trusted skill content. In a skill-management context, overwriting installed skills can change agent behavior and may replace previously reviewed instructions with untrusted or malicious content, increasing supply-chain and persistence risk.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The file states that skills are automatically installed to all detected agents, which expands the trust boundary across many tools and execution contexts without emphasizing explicit opt-in or restrictive defaults. Even though this is documentation rather than executable code, it promotes a broad propagation model where a single skill can influence multiple agents, increasing the blast radius if a malicious or unsafe skill is added.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The guide normalizes use of `--force` for overwrites in an AI-agent context without requiring verification of target, current state, or user approval. In automated workflows, this can cause unintended replacement of existing skills or configuration-backed assets, increasing the risk of destructive changes and supply-chain-style tampering if the source or target is mistaken.

Self-Modification

High

• Category: Rogue Agent

Content

|--------|-------------|
| `-p, --project` | Update project skills (default) |
| `-g, --global` | Update global skills |
| `-t, --target <dir>` | Update skills in custom directory |
| `--dir <dir>` | Update skills in exact directory |
| `-a, --agents <names>` | Filter by specific agent(s) |
| `--filter <name>` | Update only the named skill |

• Confidence: 80% confidence
• Finding: Update skill

Self-Modification

High

• Category: Rogue Agent

Content

| `-p, --project` | Update project skills (default) |
| `-g, --global` | Update global skills |
| `-t, --target <dir>` | Update skills in custom directory |
| `--dir <dir>` | Update skills in exact directory |
| `-a, --agents <names>` | Filter by specific agent(s) |
| `--filter <name>` | Update only the named skill |
| `-y, --yes` | Skip confirmation prompts |

• Confidence: 81% confidence
• Finding: Update skill

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.