Security audit

coware-skills

Security checks across malware telemetry and agentic risk

Overview

Coware has a legitimate shared-spec syncing purpose, but it lets a remote setup guide and sync scripts drive sensitive account, project, and upload actions with too little user review.

Install only if you trust Coware and intend to use it for a team project. Before first use, ask the agent to show the fetched setup guide, confirm any login/project/invite-code steps, inspect the .coware Node scripts in the repo, and avoid syncing specs that contain secrets or sensitive internal architecture.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill instructs the agent to fetch a remote guide and follow all instructions end-to-end, including login and project actions, without constraining what the remote content may require. This effectively delegates agent behavior to an external server and expands the skill beyond spec synchronization into potentially sensitive account, network, and project-modification actions.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger conditions include broad phrases like shared specs, API alignment, team coordination, and multi-dev workflow, which can match many ordinary development requests. Overbroad activation increases the chance the skill runs in contexts where users did not intend external sync/setup behavior, raising the risk of unexpected network access or workflow hijacking.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill directs the agent to fetch remote setup content from an external URL without any user-facing disclosure or consent step. This creates an undisclosed data flow and allows externally hosted instructions to influence behavior before the user approves network retrieval.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill tells the agent to run a sync command that pushes updated spec files to a server, but it does not clearly warn that project interface specifications may be transmitted externally. Because specs can contain sensitive architecture, endpoint, and data-shape information, silent syncing can cause unintended data exfiltration.

Ssd 4

Medium

Confidence: 97% confidence
Finding: The setup flow treats the remote guide as authoritative, requires following all instructions in order, and forbids pausing to ask the user questions mid-flow. This is a classic remote-instruction redirection pattern: once the guide is fetched, it can steer the agent into broader actions without meaningful user oversight.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.