Security audit

brand-guidelines

Security checks across malware telemetry and agentic risk

Overview

The skill is not clearly malicious, but its broad file, command, API, and workflow authority is poorly scoped for a brand-guidelines skill.

Review carefully before installing. This skill should only be used in a tightly controlled workspace, with least-privilege credentials, and only after the publisher narrows its purpose, command use, file access, external endpoints, and secret-handling instructions. I did not find evidence of exfiltration, destructive behavior, or hidden persistence, so this is Review rather than malicious.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The manifest presents a narrow brand-guidelines skill, but the body broadens it into generic data analysis, workflow orchestration, API usage, file handling, networking, and command execution. This mismatch can cause the agent or user to grant the skill broader trust and permissions than its stated purpose warrants, increasing the chance of unsafe invocation and privilege misuse.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The documentation normalizes command execution as part of a brand-guidelines skill even though that function is unrelated to the declared purpose. Unnecessary shell access materially raises the risk of arbitrary system modification, destructive commands, or use of the skill as a pivot for broader host compromise.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The skill documentation introduces broad API connectivity and network-dependent behavior without tying it to a specific brand-guidelines workflow. This expands the data exfiltration and SSRF-style attack surface, especially if user-provided content, paths, or credentials influence outbound requests.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The description is so broad that it does not establish clear activation boundaries, making it easier for the agent to apply the skill in contexts far beyond brand-guidelines work. Overbroad routing increases the probability that powerful tools like read and exec are used in inappropriate or sensitive situations.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The listed applicable scope spans development, operations, and content creation without meaningful limits, which is unsafe for a skill carrying file access and execution capability. Such breadth encourages accidental or policy-bypassing use in higher-risk environments unrelated to the skill's stated function.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The documentation instructs users to configure API keys and perform external API calls but does not explain how secrets are stored, scoped, redacted, or protected from leakage. This can lead to unsafe credential handling and unintended disclosure of sensitive data to third-party services.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill states it needs file read/write permissions and command-line tools, but it does not clearly warn users that these operations can alter local state, access sensitive files, or affect system integrity. Missing disclosure is dangerous because users may invoke the skill without understanding the operational risk.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.