Security audit

Skill Radar

Security checks across malware telemetry and agentic risk

Overview

The skill is a coherent routing tool, but it asks agents to run a per-query shell command with raw user text and gives itself broad influence over which other skills are loaded.

Install only if you are comfortable with a meta-skill influencing skill loading on most queries. Use a safe subprocess/API integration rather than interpolating user text into a shell command, keep the HTTP server bound to trusted local use, and review or tighten routing rules before relying on it for security-sensitive workflows.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 82% confidence
Finding: The skill clearly instructs the agent to execute local code, read skill directories, auto-generate files, and optionally run an HTTP service, yet it declares no permissions or safety boundaries. In an agent ecosystem, undeclared filesystem and network capabilities are dangerous because they expand the trust boundary invisibly and can cause operators or higher-level policy engines to authorize behavior they did not expect.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 88% confidence
Finding: The skill is presented primarily as a lightweight routing layer, but the documented behavior also includes CLI execution, filesystem scanning/parsing, file generation, and running an HTTP microservice. That mismatch matters because a meta-skill loaded early in the agent lifecycle has elevated influence over what other skills are seen, so understating its operational scope can hide meaningful attack surface and trust implications.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The server exposes a GET /skills endpoint that enumerates registered skills, including names, keywords, and priority values. In a routing layer that sits before other skills are loaded, this increases attack surface by leaking internal capability metadata that can help an attacker craft targeted prompts, fingerprint the agent, or discover hidden functionality; the permissive CORS header further broadens who can read this data from a browser context.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill explicitly tells the agent to run a shell command containing the user's raw query inside double quotes. Even if the underlying runtime sometimes escapes arguments safely, the markdown instruction itself is unsafe-by-design because many agent implementations will interpolate the query into a shell string, enabling command injection or argument-breaking payloads; this is especially dangerous here because the skill runs before other skills load and affects global dispatch.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The routing keywords include very broad terms such as "bug" and especially "code", which are likely to match many unrelated developer queries. Because this skill runs before other skills are loaded and can restrict context to only top-matching skills, overmatching can misroute requests and suppress more appropriate skills, degrading both correctness and security-relevant task handling.

Vague Triggers

Low

Confidence: 95% confidence
Finding: The abbreviation "CR" is ambiguous and can refer to many unrelated concepts, making accidental activation likely. In a routing skill that intercepts queries before other skills are considered, this ambiguity can cause incorrect skill loading and reduce availability of the intended skill set.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The standalone keyword "usability" is broad and likely to appear in many product, QA, accessibility, or research requests that are not specifically asking for UI feedback. In a routing skill that intercepts requests before other skills load, this can cause over-selection of this skill and misroute user intent, reducing the chance that the correct downstream skill is chosen.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: This regex combines generic verbs like "check" and "evaluate" with common nouns like "page", "screen", and "layout", creating a trigger that can match many unrelated requests. Because this meta-skill acts as a front-door router and loads only top-ranked skills, ambiguous matching can suppress more appropriate skills and steer the agent into an incorrect capability path.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The routing rule uses very broad standalone keywords such as 'weather', 'rain', and 'sunny', which can cause this skill to match queries that only mention these terms incidentally rather than actually requesting weather help. In a meta-skill that intercepts queries before other skills load, overbroad triggers can misroute requests, suppress more appropriate skills, and bias the agent's context selection.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.