Siluzan CSO

• Outcome: Review
• Latest audit: Jul 24, 2026 · 10:16 AM UTC
• Version: 1.1.33

Overview

The skill’s CSO publishing workflow is mostly coherent, but its installer makes broad lasting system changes and runs remote code with too little user control.

Review the installer before running it. Prefer a manual install that keeps npm’s registry unchanged, avoids piping remote scripts into shells, and registers the skill only in the assistant you intend to use. Treat CSO credentials, OAuth links, json-out account snapshots, uploaded media, and publish actions as sensitive; confirm target accounts and content before any upload, account change, planning generation, retry, delete, or publish operation.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (31)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: The skill is presented as a CSO content/operations workflow, but it also instructs the agent to perform broad system-level setup actions: fetching remote scripts, installing Node.js and packages globally, and registering skills into assistant directories. This expands trust and execution scope far beyond normal content/publishing workflows, increasing supply-chain and unauthorized system modification risk if the skill is invoked unexpectedly or with broad triggers.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The skill explicitly recommends `bash <(curl ...)` and PowerShell `irm ... | iex`, both of which execute downloaded remote content immediately on the user's machine. This is dangerous because it bypasses inspection, creates a supply-chain execution path, and grants the remote host effective code-execution capability if the endpoint or package distribution is compromised.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The publish workflow explicitly permits the AI to directly polish or adapt copy inside the publishing flow, which conflicts with the skill boundary that requires copy generation and revision to go through the dedicated content-writer workflow and forbids direct drafting/chat-based polishing. This can cause policy bypass: an agent handling a publish request may perform unreviewed content generation in the wrong tool context, defeating routing controls, auditability, and any safeguards implemented in the dedicated writing workflow.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The installer preemptively downloads and installs Git for Windows from a vendor-controlled CDN as a fallback for agent clients, even though Git is not required for the stated CSO business functions. This expands system capabilities and introduces an additional remote binary trust boundary, increasing attack surface if the CDN, URL, or bundled installer is compromised.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The script changes the user's global npm registry to a third-party China mirror, which affects all future npm installs on the system rather than only this package. That creates a supply-chain and integrity risk because subsequent packages may be fetched from a different repository without the user's informed consent.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The installer registers the skill into multiple AI assistants' global skill directories using a forced global initialization, extending the skill's reach beyond the immediate product context. This broad persistence increases blast radius if the skill is flawed or later updated maliciously, because many assistants may load it automatically.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The installer force-runs `siluzan-cso init --global --force`, which registers the skill into many AI assistants' global skill directories without limiting scope to the current tool or obtaining consent. This expands the software's reach beyond ordinary CLI installation and can create persistence and unintended activation across unrelated assistants.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The script changes the user's global npm registry to `https://registry.npmmirror.com`, affecting all future npm operations on the system rather than only this package install. This introduces a supply-chain trust change outside the skill's stated purpose and can redirect dependency resolution through a third-party mirror without informed consent.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The workflow explicitly authorizes writing to and modifying persistent files under `~/.siluzan/content-library/`, including ongoing optimization and pruning, during normal content-generation tasks. That exceeds a narrowly scoped writing workflow and creates a risk of unintended persistent state changes, corruption of user-owned materials, or silent cross-session data tampering without explicit per-action consent.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger keyword list contains very broad everyday phrases related to writing, editing, replying, and posting, which can cause the skill to activate in contexts the user did not intend. In this skill, accidental activation is more dangerous because activation can lead to shell-enabled operational flows and installation guidance, increasing the chance of unnecessary privileged actions.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill presents remote install-and-execute commands as straightforward setup steps without clearly warning that they run untrusted downloaded code on the user's system. This can normalize risky behavior and reduce informed consent, especially when the agent is encouraged to 'directly help the user execute' the scripts.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger phrases shown here are very broad, generic user utterances such as asking to write, review, or revise text. In an agent/skill-routing context, overly broad triggers can cause the skill to activate on ordinary conversation that was not intended for this workflow, leading to misrouting, unwanted tool usage, or bypass of more appropriate specialized skills.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The document instructs operators to display and manually copy a full OAuth authorization URL in constrained environments, but it does not warn that the link is sensitive, time-bound, and should only be opened by the intended user for the correct account. OAuth URLs can carry state and client parameters, and exposing or mishandling them can lead to accidental authorization of the wrong account, phishing-style confusion, or leakage through logs/chat history.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The documentation advertises `--upload` as automatically sending extracted cover images to a remote asset library, but it does not clearly warn users that local video-derived content will be transmitted off-device. In this skill context, the extracted frame may contain unreleased media, sensitive internal content, or customer data, so omission of an explicit disclosure and confirmation expectation increases the risk of unintended data exfiltration.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation explicitly encourages using `--json-out` to persist account records containing identifiers and token-related fields such as `externalMediaAccountTokenId`, but it does not warn that these files may contain sensitive operational metadata and should be protected. In an agent setting, this can lead to insecure local storage, accidental inclusion in logs, workspaces, or source control, and later misuse of account identifiers or token references during publishing workflows.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: The script silently changes npm configuration without confirmation or a prominent warning, so users may not realize that a persistent package-management setting has been altered. Hidden configuration changes are dangerous because they undermine user trust and can redirect unrelated future dependency installs through a different supply-chain path.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: Forcing a specific regional registry mirror without opt-in removes the user's ability to choose their own package source and trust model. In the context of an installer that runs with the user's privileges, this is a meaningful supply-chain risk because it can affect all later npm activity, not just installation of this skill.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The installer silently updates the global npm registry with no prior prompt, warning of lasting side effects, or easy restore step. Unannounced persistent environment changes reduce user control and can lead to future package installations being sourced from an unintended registry.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script force-registers the skill across multiple assistant ecosystems without confirmation, creating hidden side effects beyond a normal package install. Because registration is global and forced, users may unknowingly expose multiple agents to this skill and make later removal more difficult.

Ssd 4

Medium

• Confidence: 88% confidence
• Finding: This section explicitly instructs writers to construct 'opponent,' 'our side,' insider cues, and moral justification as reusable persuasion components. In a content-operations skill, that can systematically amplify manipulative, divisive messaging and enable targeted social-engineering style content, especially when combined with persona and audience tailoring.

Ssd 4

Medium

• Confidence: 91% confidence
• Finding: The quality checklist operationalizes manipulative tribal framing by requiring a specific enemy, group boundary, insider signals, and a moral-validation ending before content can pass. Because this is framed as a release gate, it normalizes and scales coercive persuasion techniques across outputs rather than treating them as optional rhetoric.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

linux)
      if command -v apt-get >/dev/null 2>&1; then
        info "Installing Node.js 22.x via NodeSource (apt)..."
        curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash -
        sudo apt-get install -y nodejs
      elif command -v yum >/dev/null 2>&1; then
        info "Installing Node.js 22.x via NodeSource (yum)..."

• Confidence: 92% confidence
• Finding: sudo

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

sudo apt-get install -y nodejs
      elif command -v yum >/dev/null 2>&1; then
        info "Installing Node.js 22.x via NodeSource (yum)..."
        curl -fsSL https://rpm.nodesource.com/setup_22.x | sudo -E bash -
        sudo yum install -y nodejs
      else
        info "Installing Node.js LTS via install-node.vercel.app..."

• Confidence: 92% confidence
• Finding: sudo

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

linux)
      if command -v apt-get >/dev/null 2>&1; then
        info "Installing Node.js 22.x via NodeSource (apt)..."
        curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash -
        sudo apt-get install -y nodejs
      elif command -v yum >/dev/null 2>&1; then
        info "Installing Node.js 22.x via NodeSource (yum)..."

• Confidence: 92% confidence
• Finding: sudo -E

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

sudo apt-get install -y nodejs
      elif command -v yum >/dev/null 2>&1; then
        info "Installing Node.js 22.x via NodeSource (yum)..."
        curl -fsSL https://rpm.nodesource.com/setup_22.x | sudo -E bash -
        sudo yum install -y nodejs
      else
        info "Installing Node.js LTS via install-node.vercel.app..."

• Confidence: 92% confidence
• Finding: sudo -E

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.