Security audit

PIV - Plan Implement Validate

Security checks across malware telemetry and agentic risk

Overview

This appears to be a legitimate development automation skill, but it deserves Review because it can modify repositories, run project/PRP commands, spawn agents, and create local commits without strong built-in confirmations or command scoping.

Install only if you want an autonomous coding workflow that can change project files and create local commits. Use it in trusted repositories, review generated or existing PRPs before execution, inspect validation commands before they run, and check git status/diff before accepting commits.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The skill is presented as an orchestrator, but it also directs direct repository mutations such as creating directories/files and performing git operations. This is dangerous because users may invoke it expecting coordination-only behavior, while the skill can silently modify the local project state and commit changes without explicit consent at execution time.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The document says the orchestrator 'does not execute work itself,' but nearby instructions tell it to create directories and copy workflow/template files. That contradiction can mislead operators and downstream policy systems, increasing the chance that privileged write actions occur under a misleading trust model.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The file gives contradictory execution guidance: it first instructs invoking a codebase-analysis subagent, then immediately says not to spawn sub-agents. In an agentic workflow, conflicting delegation rules can cause unpredictable behavior, bypass expected review boundaries, or lead an agent to ignore safer execution constraints when choosing which instruction to follow.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill instructs automatic project initialization by creating directories and copying files into the repository without an explicit user warning or confirmation. Even if the actions are not inherently malicious, silent writes can alter tracked state, overwrite user expectations, and prepare the repo for later automated actions.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill directs automatic git status/diff inspection followed by creation of a semantic commit, but gives no clear upfront warning that invocation may create commits. Automated commits are especially risky because they permanently record potentially incorrect, sensitive, or partially validated changes and can trigger downstream CI/CD or sharing workflows.

Missing User Warnings

Low

Confidence: 88% confidence
Finding: The skill instructs the agent to write generated output directly to a user-specified path via `$ARGUMENTS` without any visible safeguards such as path restriction, overwrite confirmation, or checks against sensitive locations. In an agentic environment, this can enable accidental overwriting of arbitrary workspace files or placement of content in unintended paths, especially if the argument is influenced by untrusted input or automation.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill explicitly directs the agent to modify project files and execute shell commands (`read, write, edit, exec`) based on a PRP and local project inspection, but it provides no user-facing safety guardrails such as requiring confirmation before impactful actions, constraining command scope, or forbidding destructive operations. Because both the PRP and repository contents are treated as inputs, a malicious or compromised PRP could steer the executor into running unsafe commands or making harmful changes under the guise of normal workflow automation.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.