Security audit

AutoCraft

Security checks across malware telemetry and agentic risk

Overview

AutoCraft looks like a real project-automation skill, but its installer pulls and runs unpinned external code and starts network services, so it should be reviewed before use.

Install only in an isolated development environment after reviewing the external AutoCraft repository and its dependency files. Prefer pinning a known commit, binding services to localhost, and keeping project paths restricted to a disposable workspace until you trust the workflow.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (39)

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The checklist defines blocker checks inconsistently: one section states E01-E12 must all pass, while the surrounding content also defines E13/E14 as severe blocker items. This can cause an agent or reviewer to wrongly approve a PRD that missed declared critical checks, weakening governance and allowing incomplete or unsafe specifications to pass.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The review workflow says the first gate only checks E01-E09, which contradicts earlier sections that classify additional items such as E10-E14 as blocking. In practice this creates a bypass path where later blocker failures may be ignored or treated as non-blocking, leading to false approvals.

Intent-Code Divergence

Low

Confidence: 88% confidence
Finding: The required report fields only mandate output for E01-E09 and W01-W18, while the document elsewhere defines additional blocker and warning checks such as E10-E14 and W19-W20. This omission can suppress visibility of important failures in generated audit reports, making downstream reviewers believe the review was complete when it was not.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The document assigns E10 to two different checks, one for document consistency and another for user role definition. Duplicate identifiers break traceability and can cause tools or agents to overwrite results, mis-map findings, or incorrectly mark one failed check as passed.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The checklist defines blocking checks through E28 elsewhere, but this section says the first-step gate only covers E01-E25. That inconsistency can cause reviewers or downstream agents to skip mandatory checks like E26-E28, leading to incomplete API design review and acceptance of flawed specs. In a review skill, contradictory gating logic is operationally dangerous because it directly affects what gets enforced.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The severity mapping says only E01-E24 failures are 'serious' and must be fixed, even though the document defines later blocking items as mandatory as well. This silently downgrades some blocking findings, making it easier for important consistency and executability defects to be waived. In a governance checklist, that weakens enforcement rather than merely creating cosmetic ambiguity.

Intent-Code Divergence

Low

Confidence: 87% confidence
Finding: The 'required output fields' section requires per-item results only for E01-E24, while earlier sections define additional blocking checks beyond E24. This can cause generated audit reports to omit mandatory checks, reducing traceability and making reviewers think a document fully passed when some blocking items were never reported. The impact is lower than the policy contradictions above because it affects reporting completeness, but it still undermines control effectiveness.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: Two different controls are both labeled E26, creating an identifier collision between 'internal consistency' and 'no phantom APIs'. Duplicate IDs break deterministic referencing in reports, automation, and remediation tracking, so one issue may overwrite or mask the other. In an AI-assisted checklist, this is especially risky because tools often key logic by control ID.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The checklist states that blocking items E01-E30 must all pass, but later sections only require checking/reporting E01-E16. This inconsistency can cause an agent or reviewer to skip later blocking checks such as consistency and data-flow validation, producing false approvals for incomplete or unsafe database designs.

Intent-Code Divergence

Medium

Confidence: 99% confidence
Finding: Two different controls are both labeled E18, one for internal consistency and one for preventing unsupported tables. Duplicate control IDs create ambiguity in enforcement, reporting, and automation, so one requirement may overwrite or mask the other in tooling or human review.

Intent-Code Divergence

Low

Confidence: 92% confidence
Finding: The cross-reference table points to undefined warning ID W23 and contains incorrect mappings. In a review skill, broken references weaken reviewer trust and can cause checks to be skipped, misreported, or implemented incorrectly by automation consuming the checklist.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: Section 3.7 states that all blocker items E01-E33 must pass, but Section 5 narrows the blocking gate to only E01-E12. This contradiction can be exploited or accidentally used to bypass later blocker checks such as consistency, scenario coverage, slot/API alignment, and defensive coding, weakening the security and quality gate for generated component specs.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The problem severity mapping marks only E01-E12 as 'serious/must fix' even though earlier sections classify E13-E33 as blocking items too. This inconsistency can cause auditors or automated agents to downgrade mandatory issues, allowing unsafe or incomplete component specifications to pass review.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The checklist is internally corrupted because an unrelated E14 row appears inside the E12 section, which can mislead reviewers about what must be checked and how findings should be scored. In a governance or release-gating document, this kind of inconsistency can cause teams to miss real defects, apply the wrong control, or produce unreliable audit results.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The document states that BE-DEV should not have a separate decomposition/design task, but the template still includes '001: 拆解任务单'. This internal contradiction can cause downstream automation or human operators to generate extra tasks that violate the numbering/constraint model, leading to plan validation failures, blocked pipelines, or execution against the wrong task structure.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: Earlier sections explicitly say decomposition tasks were removed, but the BE-L2 template/rules still include '001: 拆解任务单'. In a workflow-driven system, this mismatch is dangerous because agents may follow the template instead of the constraint rules, producing invalid task manifests or causing pauses/problem tickets that interrupt execution.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The L3-E2E template defines task 001 as test-plan generation, while the numbering constraints define 001 as environment preparation. This inconsistency can misalign task types, verification categories, and dependency ordering, causing automated validators or execution agents to create the wrong first task and potentially skip required environment setup.

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The example initialization script is labeled as setting up an L2 test database, but its default path points to `backend-dev/tasks.db`, which appears to be a development database. It then calls `clear_all_tables(conn)` and issues unconditional `DELETE` statements, creating a credible risk that a user copies the sample and wipes real development data under the mistaken belief they are operating on isolated test data.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The checklist header and stated review scope do not fully match the documents that the body later requires reviewers to assess, creating a source-of-truth inconsistency. In a governance/checklist skill, this can cause reviewers to omit required L1-related documents and incorrectly approve an incomplete cross-document audit, weakening quality and control coverage.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: This audit item points reviewers to documents 32/33 for consistency checking, while adjacent text says the authoritative comparison should be against 30/31. That mismatch can direct auditors to validate against the wrong artifacts, producing false pass/fail decisions and allowing real inconsistencies in L1 acceptance standards to slip through.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The signature/sign-off section states that only documents 21+22+23+24 were audited, contradicting earlier sections that expanded the review to include L1 documents 30/31. Because sign-off text is often used as the formal audit record, this discrepancy can legitimize an incomplete review and undermine traceability and accountability.

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: _generate_recommendations() calls self.generate_report() to obtain coverage, while generate_report() always calls _generate_recommendations() to build the report. This creates unbounded mutual recursion and can reliably crash the tool with a RecursionError or hang resource consumption, resulting in denial of service whenever report generation is reached.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The tool claims to perform strict design-document compliance checks, but its API parsing logic uses global regex searches for request method and function ID across the entire document rather than per-endpoint sections. This can misassociate metadata so multiple endpoints inherit the same method or function ID, producing incorrect validation results and undermining trust in the report.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The tool advertises functional implementation completeness checking, but the service-function validation only checks whether a function ID appears in a filename and whether the function name text appears somewhere in the code. This weak heuristic can miss unimplemented functionality or incorrectly mark incomplete code as compliant, creating a false sense of assurance in a security-relevant validation workflow.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The skill is framed as a general-purpose project execution platform for non-technical users and presents broad installation and operational guidance without clear scoping, trust boundaries, or safety prerequisites. In a skill ecosystem, this can cause users or agents to invoke it in overly broad contexts where it may fetch code, install software, and orchestrate automation beyond what the operator understands.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.