Security audit

AI偷懒检查

Security checks across malware telemetry and agentic risk

Overview

This skill openly aims to add audit hooks, but it can persistently change how other skills behave and write local audit files without enough user control.

Install only if you intentionally want a tool that edits other skills' instruction files. Use it on a named target skill, review the exact diff before replacing any SKILL.md, confirm the hook file is trusted, and avoid using it where task details or prompts should not be written to local debug files.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The trigger list contains broad natural-language phrases such as asking whether a skill is规范 or在哪里, which can plausibly appear in ordinary conversation and cause the skill to activate unexpectedly. Because this skill performs file discovery and modification of other SKILL.md files, accidental invocation can lead to unauthorized prompt/instruction changes rather than a harmless read-only action.

Vague Triggers

Medium

Confidence: 96% confidence
Finding: The rule '只要用户提到上述任意触发词，立即触发本 skill' is overly broad and removes any intent verification before execution. In this context, immediate activation is dangerous because the skill is designed to locate peer skills and append or remove content from their instruction files.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The description presents the behavior as checking quality and adding/removing hooks, but does not clearly warn that it modifies another skill's SKILL.md contents and can restore or alter peer instruction files. This lack of transparency increases the chance that users invoke a destructive or persistence-affecting operation without understanding the consequences.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill explicitly instructs the agent to create or overwrite a local file (`debug_[SKILL名称].txt`) as part of its normal flow, but does not require prior user consent or even a warning that filesystem changes will occur. In an agent setting, silent file creation can violate user expectations, clutter workspaces, overwrite existing files with matching names, or be abused to persist data outside the visible chat flow.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The hook is declared as a mandatory final step with language like '强制执行，不得跳过' and '未执行自审计即视为任务未完成', but it does not define clear scope boundaries, consent requirements, or conditions under which the hook should run. In an agent setting, this can override user intent and cause the model to perform additional actions automatically after unrelated tasks, creating a policy-bypass and hidden-action risk.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill mandates writing audit results to a local file named debug_[SKILL名称].txt without any user-facing disclosure, approval step, or data-minimization rule. This is dangerous because it creates an implicit side effect on the filesystem that may leak sensitive prompt, task, or environment data and normalizes covert persistence by the skill.

Ssd 4

High

Confidence: 99% confidence
Finding: This skill is explicitly designed to discover other skills and append an externally sourced 'audit hook' into their instruction files, while framing the action as benign quality checking. That behavior is effectively cross-skill prompt/instruction injection with persistence, allowing one skill to alter the behavior of peer skills without strong trust boundaries or provenance checks.

Ssd 1

High

Confidence: 99% confidence
Finding: The injection workflow requires reading arbitrary external content from skill-audit-hook.txt and appending it verbatim to another skill's instruction file. Semantically this is prompt injection into peer agent behavior with persistence across sessions, and the 'audit' framing conceals that the true effect is to modify trusted instructions using untrusted external input.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.