Security audit

analyze

Security checks across malware telemetry and agentic risk

Overview

This skill is mostly a structured-analysis prompt, but it also advertises file writing, external API use, and command execution without clear scope or consent boundaries.

Review this skill before installing. It is not malicious from the inspected artifact, but use it only if you are comfortable constraining the agent yourself: do not allow command execution, file writes, or external API calls unless the user explicitly asks and the data being sent or changed is clear.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The manifest frames the skill as a read-only structured analysis tool, but the body advertises broader operational capabilities such as file writing, external API integration, and command execution. This mismatch is dangerous because users or agent orchestrators may invoke the skill under a low-risk assumption while the documentation encourages actions that expand data exposure and execution risk.

Context-Inappropriate Capability

High

Confidence: 94% confidence
Finding: Command execution is not justified by the stated purpose of general structured analysis, yet the skill advertises it as a feature. Even if not technically available in the manifest, describing exec as normal behavior can socially engineer an agent or user into performing shell actions that could expose secrets, modify the environment, or run unsafe commands.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: Advertising external API integration for a local analysis skill expands the trust boundary and can lead to unannounced data exfiltration to third-party services. In context, this is more dangerous because the skill presents itself as a general-purpose analyzer, so users may provide sensitive code, documents, or business data without expecting remote transmission.

Intent-Code Divergence

Medium

Confidence: 82% confidence
Finding: The document gives conflicting statements about API key requirements, saying no extra API key is needed and later saying some features do require API keys. This inconsistency can mislead users about when external services are involved, undermining informed consent and increasing the chance that sensitive data is sent to remote systems unexpectedly.

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: The manifest declares only a read tool, while the documentation claims write operations and command execution. This capability mismatch is dangerous because security controls, reviewers, and users may rely on the manifest as the authoritative boundary, while the prose encourages higher-risk actions outside that boundary.

Vague Triggers

High

Confidence: 91% confidence
Finding: The trigger keywords are extremely broad and likely to match ordinary requests involving analysis, code, data, or input. Over-broad activation increases the chance the skill is selected in inappropriate contexts, where its misleading claims about broader capabilities could influence agent behavior or user expectations.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill advertises file writing, external API use, and command execution without prominent user-facing warnings or consent boundaries. In a skill marketed for generic analysis, this lack of warning materially raises the risk of unsafe operation, surprise side effects, and data handling beyond what the user intended.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.