Security audit

AgentArts To OfficeAce

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent AgentArts skill generator, but it handles API keys in risky ways and includes a certificate-disabled network fallback that users should review before installing.

Review before installing. Use a restricted AgentArts token, prefer AGENTARTS_API_KEY over --api-key, remove any default key from generated invoke_agentarts.py before sharing or committing it, generate only into an empty intended directory, and disable or audit the IP-direct TLS-bypass fallback before production use.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill declares no explicit permissions while its documented behavior requires environment access, file generation, and execution of commands that can perform file writes and network-relevant operations. This under-declares capability and weakens operator visibility and consent, increasing the chance the skill is run in a more privileged context than users expect.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The documented purpose is simple skill generation, but the finding indicates materially riskier behavior: embedding API keys into generated artifacts, partial secret disclosure in console output, extra analysis logic beyond stated scope, and SSL-disabled IP-direct fallback. This mismatch is dangerous because reviewers and users may authorize the skill under false assumptions while it creates long-lived secret exposure and unsafe network behavior.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: The skill instructs the agent to invoke shell commands via bash to generate artifacts, which is stronger than a pure templating workflow and expands the attack surface to command execution. If user-supplied parameters are later interpolated into shell commands, this can also become a command-injection path or lead to unintended filesystem modification.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The README shows a realistic Bearer token value in a copy-pasteable command without clearly labeling it as a fake placeholder. Even if the token is not valid, users may assume it is safe to reuse, and if it was ever real it would constitute immediate credential exposure; additionally, realistic secrets in documentation normalize insecure handling of API keys.

Missing User Warnings

Medium

Confidence: 99% confidence
Finding: Passing an API key on the command line can expose the secret through shell history, process listings, audit logs, and CI/CD command traces. In a skill factory context, this is especially risky because the workflow encourages repeated generation and handling of many credentials, increasing the chance of credential leakage and downstream compromise of AgentArts endpoints.

Missing User Warnings

Low

Confidence: 76% confidence
Finding: The skill does not clearly warn that it will create files in the current or chosen output directory, which can lead to unexpected file creation or overwriting in sensitive locations. While not as severe as secret leakage, this is a real safety issue in an automation context because users may run it from directories containing important files or repositories.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The generator embeds the supplied API key directly into both SKILL.md and invoke_agentarts.py, creating plaintext credential storage in generated artifacts. This is dangerous because those files are likely to be shared, committed to source control, or exposed to other users, leading to credential leakage and unauthorized access to the AgentArts workflow.

Ssd 3

Medium

Confidence: 94% confidence
Finding: The template instructs generated skills to return raw permission-error content directly to end users. Raw upstream error messages can disclose internal identifiers, backend paths, policy details, account information, or other sensitive operational metadata that helps attackers enumerate systems and permissions.

VirusTotal

59/59 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/main.py:266