Security audit

Code Dev Toolkit

Security checks across malware telemetry and agentic risk

Overview

This enterprise coding-workflow skill is not overtly malicious, but it asks agents to use broad command, CI/CD, webhook, and audit-log capabilities without enough scoping or privacy controls.

Install only if you want an agent to help run repository-level development workflows. Keep CI/CD tokens least-privileged, use trusted webhook endpoints only, and disable or narrow audit logging unless your team has reviewed what gets recorded and how long it is retained.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The documentation states that no extra API key is needed, but immediately introduces CI/CD tokens and review webhooks for external integrations. This can mislead users about the security and trust boundary of the skill, causing them to provide credentials or enable networked behaviors without clearly understanding that secrets and project metadata may be transmitted to third-party systems.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The capability coverage language is extremely broad and maps the skill to generic coding, workflow, review, and delivery scenarios without narrow activation constraints. In an agent environment, this increases the chance the skill will trigger on common developer requests and perform higher-impact actions than the user expected, including orchestration, review, or delivery-related steps.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill describes automatic reviewer assignment, audit logging, and CI/CD delivery actions as normal workflow steps but does not warn that these actions can modify project state, create logs, or interact with external systems. That omission weakens informed consent and can lead users to invoke actions that expose code, metadata, or workflow state beyond their intent.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The credential and webhook configuration documents how to supply secrets and external endpoints but does not clearly warn that repository content, review data, or metadata may be transmitted to outside services. In practice, this can cause accidental disclosure of sensitive development information to third-party systems under the guise of routine integration.

Ssd 3

Medium

Confidence: 89% confidence
Finding: The skill normalizes broad audit logging of development activity and long retention without defining minimization boundaries, exclusion rules, or content sensitivity controls. In a coding workflow, logs can easily capture source code, secrets, tickets, prompts, and security findings, creating a secondary data exposure surface if retained or shared improperly.

Ssd 3

Medium

Confidence: 93% confidence
Finding: The enterprise configuration explicitly enables tracking all changes, which instructs comprehensive collection of project activity with no safeguards around scope or redaction. In development environments, 'all changes' can include proprietary code, credentials, personal data, and internal security context, making the logging feature materially more dangerous than ordinary operational telemetry.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.