Security audit

Aegis Bridge

Security checks across malware telemetry and agentic risk

Overview

Aegis Bridge is a coherent local Claude Code orchestration skill, but its examples normalize auto-approving high-impact agent actions such as bash and permission prompts.

Install only if you intentionally want a local Aegis service to control Claude Code sessions in your repositories. Prefer project-scoped MCP setup, restrict workDir to trusted repos, review bash and permission prompts manually, and avoid the auto-approval heartbeat template unless you are running in a tightly sandboxed environment with an explicit allowlist.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill clearly instructs the user to run shell commands such as curl, bash scripts, jq, and polling loops, yet it does not declare corresponding permissions or prominently warn about that capability. This creates a trust and transparency problem because users may invoke a skill expecting documentation-only behavior while it actually drives local command execution and session orchestration.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 85% confidence
Finding: The skill description emphasizes orchestration of Claude Code sessions, but the content also references MCP setup and health-check scripts that may modify configuration or perform setup actions outside simple orchestration. This mismatch can mislead users about what the skill may do, reducing informed consent and making risky local changes more likely to be approved.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill instructs users to approve permission prompts, bash approvals, and plan-mode actions, but it does not place a clear safety warning at the top explaining that these approvals can lead to local system changes. In context, this is dangerous because the whole purpose of the skill is to spawn coding sessions that may run commands, read repository data, and act through an HTTP/MCP bridge.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The documented /v1/sessions/:id/bash endpoint enables arbitrary shell command execution in a Claude Code session, yet the quick reference provides no safety guidance, constraints, or validation expectations. In a skill specifically designed to orchestrate coding agents, this increases the chance that downstream users or agents will treat dangerous shell execution as routine and invoke destructive commands against the local workspace or host environment.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The template explicitly auto-approves permission and plan prompts, removing a key safety gate for actions the agent wants to perform. In an orchestration loop for coding agents, this can authorize unsafe shell commands, file changes, or other privileged operations without human review, especially in CI or unattended workflows.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The workflow explicitly instructs users to auto-approve permission prompts, which removes an important human safety gate before privileged or risky actions are executed. In an orchestration skill that spawns coding agents and batch workflows, this materially increases the chance of unintended file changes, command execution, or other sensitive operations proceeding without review.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.