skill-hub-query

• Outcome: Pass
• Latest audit: Aug 23, 2026 · 7:44 AM UTC
• Version: 1.3.0

Overview

This is a disclosed hub-management skill whose network access, token use, local cache, installs, and metadata edits match its stated purpose, with operational cautions.

Install this only if you want an agent to manage skills from a trusted compatible Hub. Configure SKILL_HUB_URL and tokens only for hubs you trust, protect the credentials file, review install/edit confirmations carefully, and treat doctor.sh as a real network diagnostic that can contact the configured Hub including the /edit probe.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The trigger phrases include broad natural-language prompts like 'install X' and 'what's new on the hub', which can cause the skill to activate in ordinary conversation without the user explicitly intending to invoke a shell-capable hub-management tool. In an agent environment, overly broad activation increases the risk of unintended network access, querying remote hubs, or initiating install flows based on ambiguous prompts.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The workflow says that when the user asks a Hub-related question, the agent should run scripts directly, using a broad condition like 'what's on the hub' or 'install X'. This creates an unsafe default where ordinary discussion can trigger shell execution and outbound requests before the user's intent has been clearly confirmed.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The diagnostic prints credential-adjacent information to stdout, including a masked token indicator and the authentication header name. Even when partially masked, these values can leak into terminal logs, CI output, screen recordings, or support tickets and increase the chance of credential exposure or account targeting.

External Transmission

Medium

• Category: Data Exfiltration

Content

edit_prefix="${SKILL_HUB_EDIT_PREFIX:-${HUB_LEGACY_API_PREFIX}}"
  echo "  probe /edit endpoint: PUT ${edit_prefix}/edit/__probe__ (empty body, expect 404)"
  edit_body="$(mktemp)"; _DOCTOR_TMP_FILES+=("$edit_body")
  edit_http="$(curl -sSL --max-time 10 -o "$edit_body" -w "%{http_code}" \
    -X PUT \
    -H "Content-Type: application/json" \
    -d '{}' \

• Confidence: 83% confidence
• Finding: The script performs an unsolicited network PUT to a configured Hub endpoint as part of a diagnostic probe. Although the body is empty, this still causes external transmission and may interact with non-idempotent infrastructure, trigger audit events, or send requests to attacker-controlled endpoints if the Hub URL is maliciously configured.

Chaining Abuse

High

• Category: Tool Misuse

Content

local to_delete
    to_delete=$(echo "$backups" | tail -n +"$((EDIT_BACKUP_RETENTION + 1))")
    if [[ -n "$to_delete" ]]; then
      echo "$to_delete" | xargs -r rm -f
    fi
  fi

• Confidence: 84% confidence
• Finding: The retention cleanup pipes file names through xargs rm without a -- terminator, so a crafted slug that produces backup filenames beginning with '-' can be interpreted by rm as options instead of paths. If an attacker can influence the slug value, cleanup may delete unintended targets or behave unpredictably during maintenance, especially because the code performs deletion automatically.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.