Security audit

riffkit

Security checks across malware telemetry and agentic risk

Overview

Riffkit mostly matches its video-generation purpose, but its heartbeat can replace the local skill instructions from a remote URL, so users should review that update behavior before installing.

Install only if you are comfortable with Riffkit using your account session to create and manage video-generation resources and with its optional heartbeat updating the local skill definition from Riffkit's website. A safer setup is to disable automatic heartbeat updates and update the skill through a reviewed marketplace or manual install flow.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The heartbeat procedure downloads remote content and overwrites the local SKILL.md, giving the remote service control over future skill behavior. This is a self-update mechanism unrelated to the core video-generation purpose, and if the server, transport, or hosting account is compromised, an attacker can push malicious instructions into the agent's local skill definition.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The skill exposes a manual trigger path that performs version checks and can initiate self-modification of local skill files. Even if intended as maintenance, embedding update logic inside a user-facing skill expands the attack surface and creates a path for remote content to alter agent behavior outside the declared riffing functionality.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The instructions overwrite a local file without an explicit user warning or consent, which is unsafe for an agent operating on behalf of a user. Silent file modification reduces transparency and can conceal persistence or tampering, especially because the overwritten file determines later agent behavior.

Missing User Warnings

Low

Confidence: 80% confidence
Finding: The manual-trigger path writes a persistent state file in agent memory without clearly warning the user that durable local state will be created or changed. While lower severity than code self-update, undisclosed persistence can still affect user expectations, auditability, and future skill execution timing.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The trigger list includes very broad phrases such as 'make an ad', 'riff', and 'generate a short video', which can cause the skill to activate in unrelated conversations. That increases the chance of unintended API calls, auth prompts, or costly video-generation flows being initiated from ambiguous user input.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.