Security audit

Risk Guard

Security checks across malware telemetry and agentic risk

Overview

This appears to be a local Windows diagnostic skill, but it can delete workspace lock/temp files by default despite strong read-only and confirmation-focused safety wording.

Review before installing. This does not look malicious, and its behavior is mostly local troubleshooting, but install it only if you accept Windows process/port inspection, localhost health probing, workspace log/report writes, and automatic cleanup of old workspace .lock/.tmp files. Prefer a version where diagnostics are read-only by default and cleanup requires an explicit confirmation or cleanup flag.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill advertises executable behavior and imports/capabilities involving environment access, file read/write, network, and shell execution, but the manifest section shown does not declare any permissions or constraints. This creates a least-privilege and reviewability problem: operators cannot accurately assess what the skill may do, and broad implicit capabilities increase the blast radius if the skill is triggered unexpectedly or extended later.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documented purpose says the skill is a risk guard that diagnoses issues and requires confirmation for high-risk actions, yet the file explicitly carves out automatic deletion of .lock and .tmp files and indicates it writes reports to workspace memory. This mismatch is dangerous because users and reviewers may trust the skill as read-only/safety-oriented while it still performs state-changing actions without confirmation, undermining informed consent and increasing the chance of unintended data loss or abuse via broad triggers.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: Claiming the skill 'only diagnoses' while also permitting automatic deletion of workspace .lock and .tmp files is a security-relevant contradiction. Even if the targeted files are intended to be low risk, deletion is still a destructive action that can break active workflows, remove forensic evidence, or be abused if path selection and age checks are imperfect.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The skill is presented as a diagnostic and risk-confirmation guard, yet it automatically deletes .lock and .tmp files older than 10 minutes in the workspace during normal execution. In this context, automatic mutation is more dangerous because users are primed to expect read-only diagnosis or explicit confirmation before any irreversible cleanup.

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: The docstring explicitly claims lock-file deletion requires confirmation, but check_lock_files removes files automatically whenever DRY_RUN is not set. This mismatch can mislead operators into trusting the tool during safety-sensitive maintenance, causing unintended deletion of files they did not consent to remove.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The trigger phrase '诊断' is generic and likely to appear in ordinary user requests unrelated to this skill. In a skill with shell, filesystem, and possible cleanup behavior, overly broad activation increases the risk of accidental invocation, causing unintended system inspection, file writes, or deletions without the user meaning to engage this skill.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.