The ultimate Multi-Agent System for Building Automation

• Outcome: Review
• Latest audit: May 29, 2026 · 9:32 PM UTC
• Version: 2.0.6

Overview

This skill is not clearly malicious, but it asks for sensitive building-control signing authority and describes high-impact automation without enough boundaries.

Install only in a test or tightly controlled BAS sandbox. Do not provide production building-control keys, live actuator access, employee biometric data, EV/account data, or purchase authority unless you add explicit human approval, least-privilege key management, audit logging, spending limits, and privacy/consent controls.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Intent-Code Divergence

Low

• Confidence: 88% confidence
• Finding: The changelog makes strong claims of full sandbox-compliance and resolved undeclared-privilege gaps while simultaneously documenting access to a sensitive environment variable and filesystem persistence. In a security review context, unverifiable trust-building language around privileged capabilities can mislead operators, reviewers, or automated governance into underestimating the real attack surface.

Intent-Code Divergence

Low

• Confidence: 84% confidence
• Finding: The file asserts '100% verifiable compliance' and local-only behavior, yet also describes cryptographic dependencies, key material handling, and persistent storage for ledgers/PKI artifacts, which expand the sensitivity of runtime operations. This mismatch is dangerous because it can create a false sense of safety around logging and execution boundaries, especially where secrets and durable state are involved.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The file labels the main block as a harmless or 'non-destructive' test, but it actually loads a real private key and uses a host-provided secret to perform live signing. That mismatch can mislead operators into running code with production-sensitive cryptographic material under the assumption that it is only a safe demo, increasing the chance of accidental secret exposure or misuse.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: This skill reads a private key from disk and a decryption password from the host environment, then performs signing operations locally. In an agent or plugin setting, that grants the skill access to highly sensitive trust material and the ability to mint authenticated commands, which is dangerous unless tightly scoped and externally controlled.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The file advertises the main block as a 'non-destructive test version', but the test harness reads the real private key from disk, unlocks it with an environment-supplied password, and produces a valid Ed25519 authorization token. In an operational BAS/ICS context, this blurs the boundary between test and production and can enable real command authorization if the script is run in a live environment with access to governance keys.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The file claims to only perform public-key verification, but the test harness also loads the central private key and signs commands locally. In a control-system agent, colocating verification logic with privileged signing capability weakens separation of duties and increases the chance that the component can mint apparently authorized commands if run in the wrong environment.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: This skill accesses the central private key and performs signing despite being an execution/verification agent rather than a signing authority. If this agent or its runtime is compromised, an attacker could use the embedded key-management path to generate valid dispatch tokens for physical power commands, undermining the trust model for the microgrid.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The whitepaper describes aggregating room-level demand, occupancy-related signals, weather, and pricing data to drive automated building decisions, but it provides no notice about what user or tenant data is collected, how it is used, or what consent and retention controls apply. In a smart-building context, room-level telemetry can reveal occupancy patterns and behavior, creating a real privacy risk even if the document is architectural rather than executable code.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The document states that the central agent may automatically connect to external green-certificate or carbon trading interfaces and execute purchases to close carbon gaps, but it gives no warning, approval boundary, or risk disclosure for autonomous financial actions. Automated external trading can create direct monetary loss, compliance issues, or abuse if triggers, counterparties, or authorization are wrong or manipulated.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: This section describes using employee EV presence, charging control, authorization, battery energy, and account settlement data for V2G dispatch without any privacy or data-use notice. That combination can expose sensitive mobility patterns and financial/account information, and the autonomous discharge behavior could affect employees' property and trust if consent, limits, and transparency are not clearly defined.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The whitepaper describes ingesting smartwatch or biosensing data, inferring stress/fatigue from HRV, and automatically altering the employee's environment, yet provides no explicit warning, consent, or health-data handling safeguards. Biometric and health-adjacent telemetry is highly sensitive, and misuse or overcollection could lead to privacy violations, workplace monitoring concerns, discrimination risk, and regulatory exposure.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The prompt includes a control-style action button, '💰 授权套利调度', that implies authorizing real arbitrage dispatch, but it provides no safety constraints, confirmation flow, or warning about operational consequences. In an energy-management context, users could interpret the dashboard as approved for live control, leading to unauthorized dispatch, unsafe charging/discharging behavior, financial loss, or disruption of microgrid operations.

VirusTotal

67/67 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.