Security audit

ci-cd-and-automation

Security checks across malware telemetry and agentic risk

Overview

This CI/CD automation skill asks for command execution and discusses credentials/API use, but its scope and safety boundaries are too vague for that authority.

Review this skill before installing. Only use it in repositories where CI/CD automation is intended, and require explicit confirmation before it runs commands, uses API keys, contacts external services, or changes deployment-related files.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The manifest broadens a CI/CD-focused skill into generic development automation, data analysis, and workflow orchestration. This scope expansion increases the chance the agent will apply exec/network-capable behavior in contexts not justified by the stated purpose, weakening least-privilege and making misuse easier.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The deployment section documents generic API calls, file handling, and command execution rather than CI/CD-scoped actions. In a skill with read and exec tools, vague operational guidance can normalize arbitrary command or external-service use without clear constraints or approval boundaries.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: Claiming generic data analysis capability is unjustified for a CI/CD setup skill and expands operator expectations beyond the intended security boundary. This can lead to the skill being invoked on unrelated data-processing tasks where its exec capability and automation authority become unnecessarily risky.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The documentation instructs use of API keys, credential setup, and arbitrary API connectivity without limiting which services are allowed or why they are needed for CI/CD. Unscoped credentialed network access can enable data exfiltration, unauthorized system changes, or accidental use of sensitive tokens in unrelated environments.

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: The skill claims only whitelisted commands are executed, but no actual whitelist, validation rules, or enforcement mechanism is documented, while other sections describe generic command execution. In an exec-enabled skill, this mismatch creates a false sense of safety and materially raises the risk of arbitrary or user-influenced command execution.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The trigger condition says the skill auto-triggers whenever a user needs related operations, which is overly broad and ambiguous for a tool with exec capability. Over-triggering can cause the agent to invoke automation, command execution, or networked actions in situations where the user did not intend that level of authority.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill describes API setup, credentials, file operations, and command execution without a clear user-facing warning that these actions may execute commands or contact external systems. Lack of disclosure undermines informed consent and increases the chance of unsafe operation in sensitive repositories or environments.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.