Security audit

Workspace Hygiene Publish

Security checks across malware telemetry and agentic risk

Overview

This workspace hygiene skill does what it says: it audits a chosen workspace, writes a local report, and only changes memory files when fixes are explicitly enabled.

Install only for workspaces where local memory and project files may be audited. Run it first without --fix, review the generated report, and enable --fix or scheduled heartbeat use only when you are comfortable with local report creation and memory-file consolidation.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill clearly describes reading workspace files and writing a hygiene report, and it may also auto-consolidate memory files, yet the manifest declares no permissions. That mismatch is dangerous because it hides file-system capabilities from whatever approval or policy layer relies on the manifest, increasing the chance of unreviewed reads or writes across a user's workspace.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The CLI help says `--report-only` will audit and report without applying fixes, but the implementation still creates the report directory and writes a report file. This is a real integrity/behavior mismatch: users may select a supposedly non-modifying mode and still have the workspace altered, which is risky in automation or read-only expectations, though it is not a code-execution or privilege-escalation issue.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: This is the same underlying issue as SDI-1 expressed as a documentation/implementation contradiction. Misleading safety claims around non-modifying operation are dangerous because operators may trust the flag in sensitive workspaces, CI pipelines, or auditing contexts and inadvertently permit filesystem changes.

Vague Triggers

Medium

Confidence: 76% confidence
Finding: The trigger phrases are broad enough to match ordinary requests such as general cleanup or workspace health checks, which could invoke a skill that scans large portions of the workspace and writes files. In context, this increases the risk of unintended activation and surprise file modifications, especially because the skill is designed to run on recurring heartbeat workflows.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The skill documentation states that it writes a report into the workspace and elsewhere describes auto-consolidating memory files, but it does not prominently warn users that the skill can modify existing workspace content. That lack of disclosure is risky because users may assume an audit-only operation while the skill performs writes or restructures memory artifacts.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.