Security audit

Agent Autonomy Kit

Security checks across malware telemetry and agentic risk

Overview

The skill is transparent about making agents work autonomously, but it encourages scheduled unattended action, file updates, and optional team-channel posting without strong user-control boundaries.

Install only if you intentionally want an agent to keep working from a task queue without fresh prompts. Before enabling cron or team-channel posting, restrict the queue to approved low-risk tasks, avoid credentials or confidential details in logs and reports, use isolated sessions where possible, and keep an easy way to disable the scheduled jobs.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The README explicitly encourages an agent to 'stop waiting for prompts' and to operate continuously, which can normalize broad self-triggered work without sufficiently constraining scope, authority, or approval boundaries. In an agent skill, this increases the risk of unintended autonomous actions, especially when paired with heartbeats, task queues, and unattended scheduling.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The setup instructions tell users to replace heartbeat behavior, run it frequently, and perform ongoing queue updates and logging, but they do not clearly warn that this can cause unattended file modifications and scheduled actions without a fresh human prompt. That omission is dangerous because operators may enable persistent autonomous behavior without understanding that the agent will continue editing local state and acting on future heartbeats.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The README instructs agents to communicate progress, handoffs, blockers, and discoveries through Discord or similar channels, but it does not warn about the risk of autonomously disclosing sensitive project data to external services. In context, an always-on autonomous agent increases the chance of oversharing internal information, credentials-adjacent details, or confidential work artifacts outside the local environment.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The quick-start section explicitly instructs users to set up a task queue, modify a heartbeat to 'do work,' and configure cron jobs for overnight operation, all without describing activation boundaries, approval requirements, or safety checks. This can normalize persistent autonomous behavior that continues acting on user data or system state without clear consent checkpoints, increasing the risk of unintended actions or policy-violating automation.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The instructions promote scheduled, continuous operation ('cron jobs for overnight work and daily reports' and 'Watch work happen without prompting') but provide no warning that autonomous execution may affect files, services, reports, or other user-controlled resources. In this context, the omission is meaningful because the skill is specifically framed around reducing human prompting and increasing unattended activity, which makes silent side effects more dangerous.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The heartbeat template encourages proactive self-triggered work whenever nothing urgent is pending, with broad language such as 'keep working' and 'use your time.' In an agent skill focused on autonomy, this can cause unintended invocation or persistence of the workflow beyond explicit user requests, increasing the chance of unauthorized actions or excessive state changes.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The template instructs the agent to update task queues, logs, and possibly team communications, but it does not warn that these steps modify project state or may create externally visible side effects. In an autonomy-oriented skill, that omission makes silent file changes and coordination actions more likely without user awareness or confirmation.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.