Security audit
agentsecrets
Security checks across malware telemetry and agentic risk
Overview
This skill is a disclosed credential-management integration that uses a separate AgentSecrets CLI to avoid exposing plaintext secrets to the agent.
Install only if you trust the AgentSecrets CLI and publisher with credential workflows. Review workspace allowlists, production password gates, MCP registration, and any use of environment-variable injection before letting an agent make authenticated calls or sync secrets.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
64/64 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.