Back to skill

Security audit

Debug Enhancement Framework

Security checks across malware telemetry and agentic risk

Overview

This debugging skill has a coherent troubleshooting purpose, but its recovery scripts can make broad host changes without clear user approval or tight scoping.

Install only in a disposable or tightly scoped development environment unless you first remove or gate the auto-healing paths. Review and constrain service restarts, pip installation, recursive cleanup, rollback, command logging, state capture, and the external connectivity check before using it on private, shared, production, or credential-bearing systems.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (25)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
"""Restart a service that has crashed."""
        start = time.time()
        try:
            subprocess.run(["pkill", "-f", service_name], 
                         capture_output=True, timeout=5)
            time.sleep(1)
        except Exception:
Confidence
95% confidence
Finding
subprocess.run(["pkill", "-f", service_name], capture_output=True, timeout=5)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
pass
        
        try:
            subprocess.Popen(cmd, stdout=subprocess.DEVNULL, 
                           stderr=subprocess.DEVNULL)
            return RecoveryResult(
                success=True,
Confidence
83% confidence
Finding
subprocess.Popen(cmd, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
if match:
            package = match.group(1)
            try:
                subprocess.run([
                    sys.executable, "-m", "pip", "install",
                    "--quiet", package
                ], check=True, capture_output=True)
Confidence
98% confidence
Finding
subprocess.run([ sys.executable, "-m", "pip", "install", "--quiet", package ], check=True, capture_output=True)

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The diagnostics functions enumerate host environment details, disk usage, working directory, executable path, and skill filesystem contents, then print them to stdout. In an agent skill without a tightly defined operational need or access controls, this creates unnecessary reconnaissance and information disclosure that could help an attacker map the runtime and locate sensitive assets.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The diagnostics helper makes an unsolicited outbound request to an external domain purely to test connectivity. In a local debugging utility, this creates unnecessary network side effects, can leak execution context such as IP address and timing to a third party, and may violate privacy or restricted-environment expectations.

Intent-Code Divergence

High
Confidence
90% confidence
Finding
The module is presented as an error-recovery helper, but it includes destructive and host-control behaviors such as deleting files, killing processes, and installing software. This mismatch increases risk because operators may grant trust to a utility component that in practice has broad system-modification capability.

Intent-Code Divergence

Medium
Confidence
78% confidence
Finding
The network healing path performs local file deletion rather than network remediation, which is an unsafe and misleading recovery action. Misclassified errors could therefore trigger unnecessary destructive cleanup of temp/cache locations unrelated to the actual fault.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
Automatic dependency repair installs arbitrary Python packages based solely on parsed error content, giving the skill package-management authority beyond what its recovery purpose justifies. In this context, that creates a direct path to supply-chain compromise or execution of untrusted setup/install hooks.

Context-Inappropriate Capability

High
Confidence
94% confidence
Finding
The recovery component can kill and restart processes, which is a powerful host-control capability disproportionate to an unspecified skill role. In an agent environment, this can be abused to disrupt other workloads or persistence mechanisms on the host.

Vague Triggers

Medium
Confidence
92% confidence
Finding
The skill advertises applicability to essentially any skill and broadly scoped tasks like bug fixing and enhancement without clear activation boundaries or safety constraints. Overly broad triggers increase the chance an agent will invoke it in inappropriate contexts, potentially introducing invasive debugging behavior, extra logging, or operational changes where they were not intended.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The documented self-healing features include auto-restarting services, repairing files, and rolling back state, all of which can change system or application state without explicit user approval. In an agent skill context, this is dangerous because it normalizes autonomous remediation actions that may disrupt services, destroy forensic evidence, overwrite valid files, or cause unintended side effects.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
StateCapture persists arbitrary debugging state to /tmp as JSON without consent, minimization, retention controls, or permission hardening. If callers pass secrets, tokens, prompts, or user data in the state object, that information may be left on disk where other local processes or later users can access it.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The diagnostic CLI collects and prints environment and filesystem information, including PATH, HOME, Python executable, working directory, disk usage, and skill directory contents, without a disclosure warning. This can leak operational details into logs, terminals, or agent outputs, providing useful system intelligence beyond what is needed for normal skill execution.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The error handler logs the full failing command via BASH_COMMAND, which can capture secrets embedded in command lines such as tokens, passwords, URLs, or file paths. Because logs are written to disk and stderr without redaction or warning, sensitive data may be exposed to other users, log collectors, or later forensic review.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The state capture function writes user context and environment values like PATH, HOME, and PYTHONPATH to files under /tmp without access controls or user warning. Even if not the most sensitive variables, this still records operational context to a world-accessible temporary area, which can aid reconnaissance or expose private filesystem details.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The diagnostics routine performs an external network connectivity check without disclosure, causing hidden outbound traffic during debugging. This is dangerous in enterprise, air-gapped, or privacy-sensitive environments because it can leak metadata and trigger policy violations despite being unrelated to core shell debugging.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
Automatically terminating and restarting services without disclosure or confirmation is risky because recovery may alter host state in unexpected ways. In shared or sensitive environments, even legitimate recovery actions can cause outages or interfere with unrelated services.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The cleanup routine deletes files and directories recursively with no user-facing warning, making destructive behavior easy to trigger as part of healing. Because directories include broad locations like `/tmp` and `/home/user`, mistakes or symlink/path issues could cause unintended data loss.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
`recreate_directory` removes an existing directory tree before recreating it, without warning or validation of ownership/scope. If given an unsafe path, this can destroy arbitrary data and is especially dangerous in an auto-healing module likely to run unattended.

Missing User Warnings

Medium
Confidence
71% confidence
Finding
The fallback logic performs outbound HTTP requests without disclosure, which may violate environment policies or unexpectedly leak metadata such as IP address and timing information. While not inherently malicious, silent network activity in a recovery component broadens exposure beyond stated expectations.

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The rollback code deletes the target path before restoring from backup, with no user-facing warning or transactional safety. If the backup is stale, corrupted, or the copy fails mid-operation, the result can be destructive loss of the original target.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
Configuration healing overwrites `config.json` automatically, which can erase operator settings or security controls unexpectedly. In an unattended skill, silent config reset may weaken protections or break intended behavior.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
Installing packages via `pip` without disclosure or approval is a high-risk system-changing action, especially in a recovery path where it may be triggered by crafted failures. This materially increases the danger of the module because it silently modifies the runtime and trusted dependency set.

Unvalidated Output Injection

High
Category
Output Handling
Content
"""Restart a service that has crashed."""
        start = time.time()
        try:
            subprocess.run(["pkill", "-f", service_name], 
                         capture_output=True, timeout=5)
            time.sleep(1)
        except Exception:
Confidence
90% confidence
Finding
subprocess.run(["pkill", "-f", service_name], capture_output

Unvalidated Output Injection

High
Category
Output Handling
Content
if match:
            package = match.group(1)
            try:
                subprocess.run([
                    sys.executable, "-m", "pip", "install",
                    "--quiet", package
                ], check=True, capture_output=True)
Confidence
97% confidence
Finding
subprocess.run([ sys.executable, "-m", "pip", "install", "--quiet", package ], check=True, capture_output

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.