Security audit

Sub-agent Orchestrator

Security checks across malware telemetry and agentic risk

Overview

This is a coherent sub-agent workflow skill, but it gives delegated sessions under-scoped authority to write detailed task logs and directly send results to external messaging channels.

Review before installing. Use this only if you are comfortable with sub-agents creating persistent task logs and potentially sending completed results to external channels. Prefer disabling external notification by default, requiring explicit confirmation before any message is sent, and deleting or redacting workspace files that may contain sensitive content.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The protocol explicitly extends a sub-agent orchestration skill into direct end-user delivery over external channels such as WeChat or Telegram. That broadens the skill's effective privilege and data flow beyond coordination, creating a real risk of unauthorized disclosure, policy bypass, or user confusion about which component is transmitting content externally.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: Granting sub-sessions direct messaging capability to external services is especially risky because sub-sessions process heavy tasks and may handle sensitive user content, intermediate analysis, or generated outputs. Allowing them to send externally without an explicit least-privilege control point materially increases the chance of data exfiltration, accidental disclosure, or misuse if a sub-session is compromised or behaves unexpectedly.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill explicitly instructs sub-sessions to create workspace files, maintain task state, and in some cases directly send messages to external channels, but it does not require an explicit user-facing confirmation or warning before those side effects occur. In an orchestration skill, this increases the risk of unintended file writes or outbound communications being performed automatically based on delegated tasks, especially when the main session sets '通知用户: true' and grants message capability.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The protocol instructs agents to persist task state and detailed step files in the workspace and also describes possible external result transmission, but it does not include any explicit warning, consent flow, retention rule, or privacy boundary. This makes it easy for sensitive prompts, reasoning artifacts, or outputs to be stored and transmitted without users understanding where their data goes or how long it remains available.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The retrospect workflow instructs a sub-session to read all files in the workspace and extract summaries, timings, and error patterns without defining data-minimization or exclusion rules. Because workspaces can contain sensitive user inputs, intermediate reasoning, or task artifacts, this broad access can lead to unnecessary collection, summarization, and propagation of sensitive content into retrospective outputs.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.