Agent Bom Vulnerability Intel

• Outcome: Review
• Latest audit: Aug 2, 2026 · 9:11 AM UTC
• Version: 1.0.3

Overview

This skill appears to be a vulnerability/SBOM scanner, but its instructions also authorize broad development actions and write/execute capabilities without clear limits.

Install only if you are comfortable with a security-scanning skill that can read project files, run commands, and write files. Use it in a controlled workspace, confirm any command or file modification before allowing it, and treat its vulnerability output format and trigger scope as under-specified.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The skill is presented as a vulnerability/SBOM scanner, but its usage steps instruct the agent to read code, perform development tasks, refactor, test, and make modifications. This semantic mismatch can cause the skill to be invoked in broader coding contexts than intended, leading an agent with read/exec/write privileges to take system-impacting actions under a security-themed label.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The documented output format shows generic code-quality grading items such as style and compliance scores rather than vulnerability findings, CVEs, affected dependencies, or remediation data. This mismatch can mislead agents and users about the skill's actual behavior, increasing the chance that unsafe or irrelevant actions are taken while appearing to be part of a security scan.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The activation text is overly broad, stating the skill should be used whenever AI model calls, intelligent dialogue, agent orchestration, or LLM applications are involved. In context, that makes a security-branded skill eligible for many unrelated requests, expanding the trigger surface for a tool-equipped agent and increasing the risk of unintended execution.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The usage section tells the agent to carry out general development actions like writing, reviewing, refactoring, and testing instead of narrowly defining how the user must invoke the scanning skill. Because the skill also declares exec and write tools, this broad procedural guidance materially increases the chance of unauthorized or unexpected modifications during what should be a read-mostly security analysis task.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill advertises file processing, API integration, and command execution, including writing files and running system commands, but does not prominently warn users that these actions may change the filesystem or execute environment-dependent operations. In a security-analysis context, that lack of explicit warning is dangerous because users may assume the skill is passive while it actually has active capabilities.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.