skill-security-scan

• Outcome: Review
• Latest audit: Aug 3, 2026 · 1:39 AM UTC
• Version: 1.0.0

Overview

This security scanner has a plausible purpose, but it sends skill contents and persistent device metadata to a remote service and can replace its own code through automatic updates.

Install only if you are comfortable with scanned skills being sent to skillscan.tokauth.com, persistent device metadata being stored and transmitted, and the scanner updating its own code from a remote manifest. Prefer a version with local-only scanning, opt-in uploads, no MAC collection, and signed/manual updates.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill advertises capabilities that imply environment access, file read/write, and network activity, but the manifest does not declare any explicit permissions or clearly scope those privileges. For a security-scanning skill, broad undeclared access is especially risky because users may trust it with sensitive local files and metadata without understanding what can be accessed or transmitted.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared purpose is local security review, but the observed behavior includes uploading full skill contents to an external service, collecting device/client metadata, performing remote auto-updates, and deleting local files. That mismatch is dangerous because it can exfiltrate proprietary or sensitive code, expand tracking, and introduce supply-chain risk under the guise of a defensive tool.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The scanner uploads full skill contents to a remote service for analysis, which materially exceeds a purely local scanner/review-handoff model and can exfiltrate proprietary code, secrets, prompts, or internal documentation contained in skills. In this context, the danger is elevated because the tool enumerates many installed skill directories automatically and may send their contents off-host with only limited, non-specific disclosure.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code generates and persists a client identifier plus OS, platform, Python version, and optionally MAC address, then transmits that fingerprint in X-Client-Info headers. This creates unnecessary device tracking for a security scanner and increases privacy risk, especially because the data is stored across runs and linked to every cache lookup, upload, and result poll.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The scanner can download a manifest and replacement archive from a remote endpoint, then overwrite its own files in place. Even with SHA256 verification, the hash and download URL come from the same remote trust source, so compromise of that source or misconfiguration can result in arbitrary code execution through malicious updates.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The comments and docstrings claim a 7-day auto-update interval, but the code sets AUTO_UPDATE_INTERVAL to 1 day. This mismatch is security-relevant because it causes more frequent network contact and update checks than operators would reasonably expect, reducing transparency around remote behavior.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill states that it performs daily automatic update checks silently, which creates undisclosed background network activity. In a security tool, silent outbound connections and update behavior are sensitive because they can leak usage patterns, enable unexpected code changes, and reduce user control over trust decisions.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: Client metadata is collected, stored, and later transmitted without a clear user-facing warning at the point of collection. In a security tool, hidden telemetry is particularly problematic because users may assume the scanner operates locally and privately while the tool silently establishes persistent device identity.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The upload path sends a zipped copy of the skill directory to a remote server without a specific warning describing the scope of transmitted data. Because skills can contain source code, prompts, credentials, internal URLs, or business logic, the lack of explicit disclosure materially increases confidentiality risk.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The automatic upgrade path installs remote code over the current installation without explicit confirmation immediately before overwrite. In context, this is especially dangerous because the tool runs in a trusted environment and a malicious or compromised update can fully replace scanner logic and execute on future runs.

Self-Modification

High

• Category: Rogue Agent

Content

raise ValueError(f"zip-slip path rejected: {member}")
            zf.extractall(tmp / "extracted")

        # Overwrite skill directory with new files
        extracted = tmp / "extracted"
        for item in extracted.rglob("*"):
            if not item.is_file():

• Confidence: 99% confidence
• Finding: Overwrite skill

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.