Security audit

code-simplification

Security checks across malware telemetry and agentic risk

Overview

This skill looks like a code-simplification helper, but it asks for command execution and describes much broader automation, file, API, and credential use than its name suggests.

Review this skill before installing. Use it only if you want a broad development automation helper, not just code simplification. Do not provide API keys or approve shell commands unless the exact command, files touched, and network/API behavior are clear; running it in a sandboxed project workspace would reduce risk.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The manifest presents this as a code-clarity refactoring skill, but the body expands scope to generic data processing, workflow orchestration, GitHub-sourced data, API use, and command execution. This mismatch can cause an agent or user to authorize the skill under a narrow trust model while it is documented to operate in much broader and potentially riskier ways.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: Granting broad exec capability to a skill whose stated purpose is readability-preserving code simplification violates least privilege. If invoked automatically or on untrusted content, the skill could run shell commands unrelated to refactoring, leading to file modification, data access, or command injection pathways through downstream implementations.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The documentation claims strict permission control and safety checks, but the manifest exposes broad command execution without concrete enforcement details. This creates a misleading safety posture that may cause operators to overtrust the skill despite lacking specified sandboxing, allowlists, or runtime guardrails.

Vague Triggers

High

Confidence: 93% confidence
Finding: The trigger language is broad and ambiguous, including generic development automation, data analysis, workflow orchestration, and code review scenarios. Overbroad triggers increase the chance that an agent selects this skill for unrelated requests, which is especially risky because the skill also requests exec capability.

Vague Triggers

High

Confidence: 96% confidence
Finding: The statement that the skill triggers whenever a user needs 'related operations' is so vague that it could match many unrelated tasks. In combination with file handling, credentials, and command execution described elsewhere, ambiguous auto-triggering materially raises the risk of unsafe or unexpected activation.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill references API keys, file operations, command execution, and environment setup, but does not provide a clear user-facing warning about possible system, filesystem, network, or data impact. Users may supply credentials or approve use under the assumption of a harmless refactoring utility, creating avoidable exposure.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.