Security audit

Automation Workflows 0 1 0

Security checks across malware telemetry and agentic risk

Overview

This is mostly a no-code automation planning guide, but it grants command-execution capability without a clear need or safety boundary.

Review this before installing. The written guide is not itself destructive and no hidden scripts were found, but the skill asks for command execution even though its apparent purpose is informational. Prefer a version with exec removed, or only install it where command execution is constrained and explicitly approved by the user.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill is presented as a purely informational planning guide, but the manifest grants exec capability without a clear documented need. Unnecessary execution privileges expand the attack surface by allowing future prompt paths, agent misinterpretation, or downstream orchestration to invoke shell commands under the skill's authority.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The file claims risky code was removed and emphasizes improved safety, yet it still declares exec capability and later describes MD+EXEC usage. This contradiction is dangerous because it can create misplaced trust in operators and reviewers, causing them to approve or invoke a skill with higher privileges than the description suggests.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The summary states the skill does not contain operational functionality, but later dependency notes state that some functions require exec command-line capability. This inconsistency can mislead users into enabling a skill they believe is passive when it may participate in command execution flows.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger keywords are broad, generic terms such as 'informational', 'guide', 'automation', and 'skill', which are likely to match ordinary user requests. Overbroad triggers increase the chance that this skill activates unexpectedly, and because it also declares exec capability, unintended invocation becomes more concerning than it would be for a passive document.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill declares exec capability but does not warn users in the markdown description that command execution may be available or triggered. Missing warnings reduce informed consent and make it easier for users or agent frameworks to treat the skill as harmless reference material when it actually carries elevated operational privileges.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.