Security audit

Apollo Workflow

Security checks across malware telemetry and agentic risk

Overview

This is a powerful coding-workflow skill that mostly matches its stated purpose, but it needs review because it can broadly activate, modify repositories, spawn agents, persist workflow state, and its packaged metadata does not match the registry identity.

Install only if you intentionally want Apollo Workflow to take over broad coding, planning, and debugging requests. Verify the publisher and resolve the _meta.json identity mismatch first. Review the shell scripts before use, avoid passing untrusted values to them, keep secrets out of task topics and result files, and approve commits, pushes, merges, PR creation, or branch deletion only after checking the branch, diff, remote, and tests.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill explicitly instructs the agent to inspect files, write plan/design documents, and create workflow state and gate files, yet it does not declare corresponding permissions. That mismatch weakens transparency and policy enforcement: users or hosting systems may not realize the skill can read and modify repository contents, increasing the chance of unintended file access or writes.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The trigger set includes very common development phrases such as 'build', 'plan', 'develop', 'debug', and 'coding task'. Because this skill can drive file inspection, document creation, and workflow execution, broad activation raises the risk of the skill taking over ordinary coding conversations unexpectedly and initiating actions the user did not intend under this workflow.

Missing User Warnings

Low

Confidence: 90% confidence
Finding: The skill instructs the agent to write and commit repository files as part of the workflow, but it does not clearly warn that these are state-changing actions requiring user awareness or approval. In an agent setting, implicit repo modifications can lead to unintended commits, branch pollution, or persistence of workflow artifacts the user did not explicitly authorize.

Shadow Command Trigger

Medium

Category: Trigger Abuse
Confidence: 90% confidence
Finding: Using 'build' as a trigger collides with a common built-in command and an extremely common user intent. In this skill, activation can lead to a structured workflow that reads repository context, writes planning artifacts, and steers execution phases, so a trigger collision can redirect benign requests into this skill unexpectedly.

Shadow Command Trigger

Medium

Category: Trigger Abuse
Confidence: 91% confidence
Finding: Using 'debug' as a trigger conflicts with a built-in command and is especially risky because the skill's Phase 4 permits direct entry into debugging mode. That makes accidental activation more dangerous: a routine request to debug could invoke this skill's workflow and associated file/state operations without clear user intent.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.