Security audit

Agent Stack Audit

Security checks across malware telemetry and agentic risk

Overview

This is a legitimate audit skill, but it asks to inspect sensitive local/account data and permits some script changes without clear enough user-controlled boundaries.

Install only if you are comfortable letting the agent inspect your automation directories, scheduled tasks, logs, API/subscription inventory, installed skills, and memory/context files. Before running it, define exact paths and accounts in scope, require redaction of secrets, and do not allow any script edits or cleanup unless you approve a specific diff and rollback plan.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The skill is framed as an audit/reporting tool, but its execution rules expand scope into making system changes after the audit. That increases the chance an agent will perform operational modifications in a context where the user expected read-only inspection, creating a safety and authorization boundary problem.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The document says never to delete anything without approval, but then creates an exception allowing unilateral code modification by commenting out API calls. This contradictory rule can authorize unauthorized changes to scripts or workflows and may disable production behavior based on an incorrect or stale determination that an API is 'dead.'

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger guidance includes broad phrases like unexpected bills or degraded reliability, which could cause the skill to activate during ordinary troubleshooting rather than a deliberate audit request. In practice, that can lead to overbroad inspection of local files, logs, subscriptions, and configuration without sufficiently explicit user intent.

Missing User Warnings

Low

Confidence: 81% confidence
Finding: The skill directs writing audit output to state files but does not clearly warn the user that local files will be created or modified. This is a consent and transparency issue that can surprise users, especially in environments where filesystem writes are sensitive or monitored.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill instructs web search and inspection of API inventories, logs, and memory files, all of which may contain secrets, billing data, internal project details, or other sensitive information. Without a privacy warning or minimization guidance, an agent may collect, expose, or transmit more data than the user intended.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.