Security audit

Cloud Architect Design Free

Security checks across malware telemetry and agentic risk

Overview

This cloud-architecture advice skill appears non-malicious, but it requests shell execution despite saying it is LLM-only and has unclear, partly unrelated trigger and operation scope.

Install only if you are comfortable with a cloud-advice skill that currently asks for shell execution. A safer version should remove exec permission, narrow triggers to cloud architecture tasks, and clarify that create/modify/delete/save terms mean generating advisory text, not changing files or cloud resources.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The skill claims to be pure Markdown/LLM-only and to not need command execution, yet the manifest permits exec and the troubleshooting section instructs users to run ping. This mismatch can mislead an agent or reviewer into granting broader tool access than the documented function requires, increasing the chance of unnecessary command execution and policy bypass through future prompt changes or user coercion.

Description-Behavior Mismatch

Medium

Confidence: 84% confidence
Finding: The documented scope expands from cloud architecture advice into generic create/modify/delete/import/export/save operation modes without defining what objects are being operated on or what safety boundaries apply. Overbroad operational verbs can cause an agent to interpret the skill as authorized to perform state-changing actions beyond advisory output, which creates room for misuse or prompt-injection-driven escalation.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The trigger condition instructs use for design creation, UI design, posters, and brand visuals, which is unrelated to cloud architecture. This can cause the skill to activate in inappropriate contexts, increasing the chance of unintended tool exposure, misrouting, or an agent following irrelevant instructions under the wrong trust boundary.

Vague Triggers

High

Confidence: 95% confidence
Finding: An overly broad and unrelated trigger condition can cause the skill to be selected in many contexts outside its intended purpose. In agent environments, bad routing is security-relevant because it may expose tools, instructions, or authority to requests that should never have invoked this skill at all.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The capability scope uses a sprawling keyword list rather than precise constraints, making invocation boundaries ambiguous. Ambiguous scope increases the risk that an agent over-applies the skill, accepts malformed requests as in-scope, or blends unrelated operations into a single run, which weakens safety controls.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.