Security audit

Agent Autonomy Kit

Security checks across malware telemetry and agentic risk

Overview

This skill openly enables unattended agent work, but it gives broad scheduled autonomy without enough scope, approval, or shutdown guidance.

Install only if you intentionally want unattended agent activity. Before enabling cron jobs, define allowed task types, writable files, posting rules, token or spend limits, logs, and a simple way to disable schedules. Avoid using it in sensitive or production workspaces until those controls are in place.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The README explicitly instructs users to configure cron-triggered autonomous work sessions that run without a human prompt, including tasks like research, writing, analysis, and spawning team members. Because these jobs can read and update task queues, memories, and coordination channels, they may act on sensitive project data or modify system state without clear consent boundaries, approval gates, or warnings about scope and side effects.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The description 'Stop waiting for prompts. Keep working.' encourages broad autonomous behavior without defining scope, approval boundaries, or safety constraints. In an agent skill, this can normalize acting without explicit user intent and may lead to unintended actions, especially when paired with queue-driven and scheduled execution concepts elsewhere in the skill.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The Quick Start explicitly instructs users to set up cron jobs for overnight work and daily reports, but provides no warning about unattended execution, approval requirements, monitoring, or limits on actions. This is dangerous because it can lead to autonomous, persistent task execution outside active user supervision, increasing the risk of unintended modifications, data exposure, or misuse of connected tools.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The template instructs the agent to autonomously enter a generic 'work mode', read a task queue, select tasks, and perform meaningful work without an explicit per-action user confirmation boundary. In an agent skill, this broad delegation can trigger unintended actions, tool use, or modification of project state based on stale or ambiguous task definitions, especially because the skill is explicitly designed to 'keep working' during idle time.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill tells the agent to update `tasks/QUEUE.md` and `memory/YYYY-MM-DD.md` and to post team updates, but it does not warn the user that the skill may modify project records or communication artifacts. This can lead to silent state changes, inaccurate logging, or unwanted edits to operational files, which is especially risky in a persistence-oriented autonomy skill because these writes become part of future agent context and team workflows.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.