Context Driven Dev Tool Free

• Outcome: Pass
• Latest audit: Jul 23, 2026 · 4:20 PM UTC
• Version: 1.0.0

Overview

This skill is a Markdown-only context-document helper with some broad file and command permissions that are mostly aligned with its stated purpose, but users should keep its write, exec, and callback use explicit.

Install only if you want an agent to help read a project and maintain context Markdown files. Treat write, delete, exec, pip install, ping, and callback_url use as opt-in actions: ask for a preview before file changes, do not provide a callback URL unless you trust the endpoint, and keep work scoped to the intended project directory.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The skill is presented as a context/document-management aid, but the documented behavior expands to generic create/modify/delete-style operations. That mismatch can cause an agent or user to grant broader authority than expected, increasing the risk of unintended destructive file actions under an innocuous-looking skill.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The skill claims to be a Markdown-based context tool with no extra API key requirements, yet it introduces callback_url-driven network behavior not central to its stated purpose. Hidden or under-disclosed network capability is dangerous because it can enable unexpected outbound communication or data exfiltration from project context.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: Callback URL support adds externally reachable network behavior to a skill whose stated purpose is local context/document management. In agent environments, this creates a clear path for sending task results, metadata, or sensitive project content to attacker-controlled endpoints if the parameter is abused.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger phrases and scenario descriptions are broad and ambiguous, making it unclear when the skill should activate. Overbroad activation criteria can cause the agent to invoke a write/exec-capable skill in contexts where the user did not intend filesystem or command-execution side effects.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The manifest advertises read/write/exec capabilities without clearly warning that the skill may alter files or run system commands. In an agent ecosystem, under-disclosed privileged capabilities materially increase the chance of unsafe invocation and user surprise.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation explicitly mentions create/modify/delete-style operations but provides no corresponding user-facing warning about destructive effects. This is dangerous because users may treat the skill as documentation-only while it can perform actions that remove or alter project artifacts.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill states that some functions require exec command execution but fails to explain the security risks of running shell/system commands. Because exec is high-privilege in agent environments, inadequate warning and scoping can lead to command misuse, harmful system changes, or execution of attacker-influenced inputs.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.