Security audit

ppshu

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed HTML diagram/prototype helper that writes generated files to a user-level gallery directory, with no evidence of hidden data access, network exfiltration, or destructive behavior.

Install only if you are comfortable with the agent creating persistent HTML files under ~/.workbuddy/ppshu by default. Use PPSHU_DIR or --dir to redirect output, and periodically delete old generated HTML files or the gallery if you do not want them retained.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill instructs the agent to read environment variables and write files via a helper script, but the manifest does not explicitly declare those capabilities. This creates a permission-transparency gap: reviewers and policy systems cannot accurately understand what the skill can access, which increases the risk of unintended file writes or environment-derived path manipulation.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The invocation examples are very generic conversational phrases such as asking to 'draw a login flowchart' or 'make a clickable prototype', which can match ordinary user requests without a clear, explicit opt-in trigger. In an agent skill system, overly broad triggers can cause the skill to activate unexpectedly, expanding its authority to generate and persist files outside the project directory and increasing the chance of misuse or surprising side effects.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger conditions are very broad, including any request to 'draw something' or 'show rather than tell.' Such generic natural-language matching can cause the skill to activate in routine conversations where file creation and rendering were not intended, increasing the chance of unwanted side effects like unnecessary file writes outside the current project.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The skill description defines applicability in overly expansive terms, effectively covering almost any scenario where visual output might help. Overbroad scope increases the likelihood of unintended invocation and automatic file-generation behavior, which is risky in an agent skill that writes persistent artifacts and opens them for presentation.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The trigger list is broad and includes common phrases such as '可视化', '流程图', and '架构图', which can cause the skill to activate for many ordinary user requests without clear user intent. In a prompt-based skill that writes files outside the repository, overbroad activation increases the chance of unintended execution, unexpected file creation, and confusion about which instructions are in effect.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The description says the skill should be applied automatically whenever a broad class of visualization-related needs is detected, but it does not define boundaries or confirmation requirements. This creates ambiguous auto-activation behavior, which is risky because the skill may take over unrelated requests and perform side effects such as storing generated HTML in ~/.workbuddy/ppshu without explicit consent.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger conditions are broad enough to capture many ordinary requests for explanation, visualization, or interactive UI, which can cause the agent to invoke this skill when the user did not explicitly ask for file creation or external artifact generation. In this skill’s context, over-triggering is more dangerous because activation leads to persistent HTML generation and presentation, increasing the chance of unexpected side effects and unnecessary file writes.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill directs the agent to persist files in ~/.workbuddy/ppshu outside the repository and emphasizes that this storage is centralized and reusable, but it does not require clear user notice or consent about where files are stored and how long they remain. In context, this is riskier because the files are designed to accumulate over time in a non-project location, making retention and discoverability easy for the system but potentially opaque to the user.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.