Security audit

keelwright

Security checks across malware telemetry and agentic risk

Overview

This skill is a coding safety wrapper, but it also directs agents to automatically change projects, install tools, commit code, and maintain persistent self-learning state without enough user control.

Review before installing. Use it only in a disposable branch, worktree, or sandbox unless you are comfortable with automatic project-root files, package installs, scanner runs, browser downloads, subagent orchestration, and commits. Disable or edit out first-load bootstrap, weekly self-improvement, and no-confirm Autopilot behavior if you need explicit approval before environment or repository changes.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (20)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill exercises meaningful capabilities including shell execution and file writes, but declares no permissions or capability boundaries. That creates a transparency and consent gap: a loader or user may treat it as documentation-only while it can direct project mutation and command execution.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The public description presents a guardrail engine, but the skill also includes operational behaviors such as project bootstrapping, archive import/export, workspace isolation, validation tooling, and browser-driven artifact generation. This mismatch increases the chance that users invoke it expecting passive review while it performs broader system and repository modifications.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The skill instructs the agent to automatically copy files into the project root on first load with no prior approval gate. Even though it announces this afterward and avoids overwrite, silent-on-load mutation is risky because loading a skill should not implicitly change a repository or create commitable artifacts.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: This guidance instructs the agent to install and execute third-party browser tooling (`npm install -g agent-browser`, downloading Chrome, then opening URLs and taking snapshots). That expands the skill from analysis/auditing into arbitrary software installation and execution, increasing supply-chain, remote content, and environment-modification risk. In this skill context, the browser requirement makes the behavior more dangerous because it normalizes networked tool installation as part of routine operation.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill directs the agent to write and execute ad-hoc Python scripts in a Temp directory, which adds general code-execution capability beyond the stated review/QA purpose. Even if intended for regression checks, this pattern enables arbitrary local script execution, can touch sensitive files, and makes it easier for an agent to pivot from analysis into unsafe actions. The surrounding context makes this more dangerous because it presents script execution as a standard convergence tactic rather than an exceptional, user-approved step.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The file markets the system as machine-enforced while explicitly carving out important controls as non-enforced guidance. That mismatch can cause operators to overtrust the skill, assume protections are automatic, and run higher-risk autonomous workflows without adding the missing enforcement externally.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The 'factual grounding' section admits there is no machine gate for verifying claims made to users, which conflicts with the broader promise of automatic safety for non-programmers. In this context, confident hallucinated instructions, URLs, versions, or commands are a real security risk because the target audience is explicitly unlikely to verify them independently.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The document says model drift is a covered failure mode, but later states the skill itself does not enforce model pinning or alert on drift. This creates a false sense of reproducibility and safety in unattended runs, where silent provider model changes can materially alter behavior and invalidate prior trust assumptions.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The weekly cron expands the skill from an in-session coding guardrail into an autonomous system that searches past sessions and mutates durable memory or skill state. That creates persistent behavior changes outside the immediate user task, with privacy, scope-creep, and instruction-poisoning risk if prior sessions contain adversarial or sensitive content.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The quick-start instruction tells users to load the skill before any coding session, which is an unusually broad activation trigger for a powerful agent-control skill. Because the skill is intended to shape autonomous coding behavior across sessions and stacks, always-on loading can cause inappropriate use outside its intended threat model, increase unnecessary trust in the skill, and widen the blast radius if the skill logic is flawed or bypassable.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The instruction to load the skill before any loop/agent coding session, autonomous run, or commit is very broad and can cause the skill to activate in many contexts. Because the skill contains write and shell behaviors, overbroad activation increases the chance of unintended mutations and surprise execution paths.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The text defines 'first load in a project' as the trigger for automatic bootstrap, but that condition is ambiguous and agent-dependent. Ambiguous trigger conditions are dangerous here because they govern shell/file-write actions, leading to repeated or accidental execution in the wrong workspace.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: The file includes a directive to emit a specific language in final summaries without user opt-in, which is a form of output steering unrelated to the user's request. In a safety/QA skill, this can distort reports, reduce operator comprehension, and create opportunities to hide or soften findings by forcing an unexpected reporting format.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The document normalizes automatic, no-prompt gate execution in Autopilot for non-programmers without a strong up-front warning about hidden actions and their operational consequences. In a skill intended for autonomous coding loops, that can lead users to enable high-autonomy behavior without understanding what will run locally or what state changes may occur.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The Autopilot integration section says all gates run automatically and the human sees only the final report, but it does not clearly warn about privacy- or system-impacting operations such as repository scans, dependency vetting, and external audit tooling. For a non-technical audience, hidden automation plus incomplete disclosure increases the chance of uninformed consent and misuse.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The file says the agent will auto-create and recreate files in the project root on first load, which is a repository mutation triggered by merely loading the skill. Implicit writes are dangerous because they can alter user workspaces, pollute repos, and normalize unauthorized file creation without clear consent.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The guidance instructs the agent to write summaries into PROGRESS.md as part of normal operation, but this is still a persistent repository modification. Even if intended for traceability, silent writes can interfere with clean working trees, CI expectations, or user policies about generated artifacts.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The weekly cron is described as autonomously updating memory and patching the skill, which are system-level modifications rather than ordinary task output. Automatic persistent changes based on retrospective session analysis can be abused by poisoned inputs and can alter future agent behavior without transparent review.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill explicitly defines an `Autopilot` mode that proceeds plan→code→test→commit without waiting for user approval, but it does not require a prominent user-facing warning or fresh confirmation before modifying the repository. In an agent environment, that increases the risk of unintended code changes, commits, and potentially downstream pushes from ambiguous or insufficiently reviewed requests.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The prompt explicitly instructs the agent to check for tools and then automatically install missing packages via pip/npm without any user confirmation. In an autonomous agent setting, this creates real risk of unreviewed system modification, unintended package retrieval from external registries, and execution of package install hooks or dependency code on the host.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/ad_hoc_verify_template.py:35