Security audit

Mini PIV - Lightweight Feature Builder

Security checks across malware telemetry and agentic risk

Overview

This feature-building skill is not malicious, but it can automatically stage and commit all repository changes, which users should review carefully before installing.

Install only if you want an agent to actively modify, test, and potentially commit code in your repository. Use it from a clean working tree, review the generated PRP and full diff before the final step, avoid untrusted repositories or PRP inputs, and keep secrets or unrelated untracked files out of the repo while running it.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill instructs the agent to run `git add -A` and `git commit` automatically, which can persist all working-tree changes without explicit user confirmation. In a feature-building workflow, this is risky because it may commit unrelated, sensitive, or partially reviewed changes and create durable side effects beyond the user’s likely expectation.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The automatic commit capability is broader than necessary for the stated purpose of discovery, planning, implementation, and validation. Because the skill is user-invocable and presents itself as a lightweight builder, embedding repository-modifying persistence steps increases the chance of unexpected source control changes that the user did not knowingly authorize.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The skill explicitly instructs the agent to implement code changes across the project and use read/write/edit/exec capabilities, which materially expands from a lightweight planning workflow into an execution-capable agent. Because the executor consumes a PRP file as input and then performs broad project modifications, a malicious or compromised PRP could drive unintended code changes or unsafe actions with little built-in constraint.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill authorizes shell command execution, including validation commands derived from the PRP and project files, without strong safeguards on what may be run. In practice, this creates command-execution risk because attacker-controlled repository content or PRP instructions can influence tool invocation, leading to arbitrary command execution, data exfiltration, or destructive changes in the local environment.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill description does not warn users that invoking it may automatically stage and commit repository changes, yet the workflow culminates in exactly that behavior. This lack of transparent disclosure and confirmation is dangerous because users may invoke the skill expecting analysis/build assistance, not irreversible version-control actions.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.