Security audit

Security Team

Security checks across malware telemetry and agentic risk

Overview

This is a coherent security-audit skill, but it asks for broad local scanning, persistence, and network-capable checks while overstating its read-only and local-only behavior.

Review before installing. Keep scan_directories narrow, assume the skill may inspect secrets and git history, do not enable scheduled scans or dashboard/webhook sync until you understand where audit data goes, and verify or fix the shell scripts before relying on this as a security monitor.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The function intended to anchor operations within the skill directory is malformed and ultimately computes a parent-of-parent path outside the script directory hierarchy. Because later logic trusts SKILL_DIR to constrain CONFIG_FILE and scan directory resolution, this breaks the security boundary and can cause the script to read configuration and inspect repositories outside the intended skill workspace.

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The root-detection logic is malformed and appears to compute a parent directory above the skill directory despite comments claiming the scan stays within the skill boundary. If this resolves outside the intended scope, the script can enumerate and inspect files in neighboring or parent repositories, exposing unrelated secrets, file metadata, and git history.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The setup instructs the agent to create directories and overwrite a state file in the user's workspace without an explicit warning or confirmation that local data will be modified. In an agent context, silent file creation and overwrite behavior is risky because users may not realize the skill is persisting state or replacing existing files, which can cause unintended data loss or unauthorized workspace changes.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill directs the agent to immediately execute local scan scripts after configuration, which may access local files, running services, and user-supplied endpoints, but it does not clearly warn the user about that access or request a final execution approval. This is dangerous because the scripts are copied from the skill package and then run, expanding the trust boundary from passive setup into active code execution and network/service interaction.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: Scheduled activation via cron/webhook is described without authentication, origin validation, or trigger constraints. That makes automated execution riskier because an untrusted or misrouted trigger could initiate scans, generate messages, or mutate local audit history unexpectedly.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: Scheduled activation via cron/webhook is described without authentication, origin validation, or trigger constraints. That makes automated execution riskier because an untrusted or misrouted trigger could initiate scans, generate messages, or mutate local audit history unexpectedly.

Vague Triggers

Low

Confidence: 80% confidence
Finding: Using vague catch-all language like 'or similar' weakens the boundary around when the skill should execute privileged audit behavior. In assistant systems this increases accidental invocation risk and makes prompt routing less predictable.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The spec explicitly describes sending locally generated audit data to a remote webhook endpoint (`/api/security/ingest`) without any mention of user consent, disclosure, minimization, or safeguards around what may be contained in `raw_log`. Security audit artifacts often include sensitive file paths, service metadata, findings, and operational details, so silent transmission to Supabase or another remote service creates a real privacy and data-exposure risk.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The trigger phrase "Run a security scan" is overly broad and can activate the skill in many contexts without clear scoping, confirmation, or exclusions. In a security-audit skill, broad activation is more dangerous because it may cause the agent to initiate sensitive inspection workflows, reveal internal paths/services, or perform actions based on ambiguous user intent.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: Running npm audit may trigger network access to the npm advisory service and disclose dependency metadata without explicit notice or consent. In a security-scanning skill, hidden outbound requests are risky because they can violate user expectations, leak package inventory, or fail in restricted environments.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: SKILL.md:18