Chief Editor Desicion

• Outcome: Review
• Latest audit: May 28, 2026, 11:32 AM
• Version:
  0.1.0

Overview

This instruction-only reporting skill is not overtly malicious, but it requires broad attachment reading, URL fetching, and report submission with weak user control and misleading source-provenance wording.

Install only if you are comfortable with the agent reading all supplied attachments, visiting selected links found inside them, and creating/submitting a detailed report from that material. Avoid using it with confidential documents unless you can review the generated wiki/report before submission, and treat its citations carefully because the instructions push the output to appear directly sourced from original URLs.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The declared purpose is a chief-editor decision skill, but the instructions expand into mandatory attachment ingestion, URL discovery, web scraping, long-form report generation, and submission workflows. This capability mismatch is dangerous because it normalizes broader data access and exfiltration-adjacent behavior than a user would reasonably expect from the skill’s stated role.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The skill makes external URL scraping mandatory for links found in attachments, even though that behavior is not clearly necessary for making an editorial decision. This creates unnecessary network access based on user-supplied documents, which can expose sensitive context, trigger requests to attacker-controlled URLs, and expand the data boundary beyond what the user likely intended.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill instructs the agent to scrape up to five URLs extracted from user attachments without warning the user that this causes external network access derived from attachment contents. This is particularly dangerous because attachments may contain sensitive or attacker-influenced links, leading to privacy leakage, outbound requests to untrusted destinations, and possible SSRF-style access if internal URLs are not blocked.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill instructs the agent to scrape up to five URLs extracted from user attachments without warning the user that this causes external network access derived from attachment contents. This is particularly dangerous because attachments may contain sensitive or attacker-influenced links, leading to privacy leakage, outbound requests to untrusted destinations, and possible SSRF-style access if internal URLs are not blocked.

Ssd 3

High

• Confidence: 95% confidence
• Finding: The skill mandates exhaustive inclusion of collected facts, data, detailed narration, and source material from attachments and derived URLs into a final report. In context, this increases the chance that sensitive information from user-provided documents or linked resources is recopied into a new artifact and then submitted, turning broad ingestion into a plain-language data leakage path.

VirusTotal

64/64 vendors flagged this skill as clean.