Security audit

css-toolkit-free

Security checks across malware telemetry and agentic risk

Overview

This looks like a CSS reference skill, but it requests command execution and file-write authority that the document itself says it does not need.

Review before installing. The CSS content itself is ordinary reference material, but the skill should ideally remove exec and write permissions or clearly explain and constrain why they are needed. Install only if you are comfortable granting a documentation-style skill command and file-write authority.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The skill explicitly claims to be a pure Markdown, offline-only document that does not require command execution, yet its manifest grants both exec and write capabilities. This mismatch is dangerous because users or orchestrators may trust the low-risk description while the skill retains materially more powerful permissions that could be abused for command execution or filesystem changes.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The manifest presents the skill as a CSS reference/consultation handbook, but also enables command execution and file modification, which are unrelated high-risk capabilities. This creates a permission-to-purpose mismatch that can enable privilege abuse, especially if the skill is auto-selected for routine developer prompts under the assumption that it is only informational.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: File write capability is unnecessary for an offline CSS reference manual and introduces the ability to alter local files or workspace contents without a clear functional need. Even if not currently used, retaining write permission increases the risk of accidental or malicious modification if the skill is invoked in a broader development workflow.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: File write capability is unnecessary for an offline CSS reference manual and introduces the ability to alter local files or workspace contents without a clear functional need. Even if not currently used, retaining write permission increases the risk of accidental or malicious modification if the skill is invoked in a broader development workflow.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The description contains broad activation language such as generic code generation, debugging, testing, and deployment usage, which can cause this skill to trigger for many unrelated development tasks. In combination with unnecessary exec/write permissions, overbroad matching increases the chance that a low-trust or irrelevant skill is selected in higher-risk contexts.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The coverage keywords list includes vague trigger terms like code generation, debugging, testing, and deployment that are much broader than the advertised CSS reference purpose. This broadens selection in agent routing systems and makes the manifest/tool mismatch more dangerous because the skill may be invoked in contexts where exec/write capabilities are more exploitable.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The manifest advertises exec and write capabilities without warning, while later sections describe the skill as pure documentation and offline-only. This inconsistency can mislead reviewers and users about the actual trust boundary, making accidental over-privileged deployment more likely.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.