Security audit

Windy Access

Security checks across malware telemetry and agentic risk

Overview

This skill is purpose-aligned, but it asks agents to install and run a third-party onboarding CLI that can write credentials across multiple runtimes, with an unsafe installer path and broad activation language.

Install only if you specifically want this agent connected to Windy services. Prefer a pinned, auditable package install over curl-to-shell, review the installer source, and confirm which runtimes and credential files will be changed before running connect. Use the disconnect flow if you later want to remove the local Windy configuration.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill directs the agent to execute a remote installer via `curl ... | sh`, which allows arbitrary code from an external host to run on the user's machine without review. In the context of a skill that also provisions credentials and modifies agent configuration, this is especially dangerous because the fetched script could exfiltrate secrets, alter files beyond the documented scope, or establish persistence.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The skill claims it ONLY runs `windy` CLI commands, but earlier instructions explicitly invoke `curl` and `pipx`. This mismatch weakens user trust and agent safety guarantees, because operators may approve the skill assuming a narrower execution boundary than what it actually performs.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The README recommends a curl-to-shell installation path without any integrity verification, pinning, signature validation, or warning about the risks of executing remote code. Even though this is documentation rather than executable skill logic, users may copy-paste it directly, enabling arbitrary code execution if the host, transport, or distribution channel is compromised.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger phrases in metadata are broad enough to match common requests like giving an agent email or setting up credentials, which may cause the skill to activate in situations where the user did not specifically intend to onboard to this third-party ecosystem. Because the skill can install software, open browser auth flows, contact external services, and write credentials, accidental invocation materially increases risk.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The 'When to use this skill' section includes vague requests like wiring in a free LLM provider or pairing an agent with identity, which are broader than the specific product integration being performed. In context, these loose triggers are more dangerous because the skill performs privileged onboarding actions and transmits data to external services.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.