Security audit

CSS避坑指南

Security checks across malware telemetry and agentic risk

Overview

This CSS guidance skill is mostly instructional, but it asks for command and write access and describes callbacks/API/file handling that do not fit a CSS pitfall guide.

Review before installing. The CSS reference material itself is ordinary, but the skill should not need shell execution, file writes, callbacks, or API-key/network workflows unless you specifically want an agent to modify project files or run diagnostics. Prefer a version with exec/write/callback/API language removed or tightly scoped.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The skill is presented as a CSS guidance utility, but later claims broader operational abilities such as file handling, API integration, information retrieval, and command execution. This capability mismatch can mislead the agent or user into granting the skill more authority than its stated purpose requires, increasing the risk of unintended execution or data access.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: Declaring exec capability for a CSS pitfall guide violates least privilege because shell/system execution is not necessary to provide styling advice. If the agent honors this permission, the skill could be used to run arbitrary commands, access local data, or pivot into broader system actions unrelated to CSS analysis.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: Introducing callback URLs and asynchronous notification behavior is unjustified for a CSS troubleshooting skill and expands the attack surface to outbound network interactions. This can enable data exfiltration, SSRF-style abuse, or covert transmission of user content if an agent passes results to attacker-controlled endpoints.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: Claiming external API integration and network communication for a CSS guide is unnecessary and can normalize outbound connectivity where none should exist. In an agent environment, unjustified network features can be abused to send prompts, files, or secrets to external systems.

Intent-Code Divergence

Medium

Confidence: 84% confidence
Finding: The document inconsistently classifies the skill as both MD+EXEC and pure MD, creating ambiguity about whether code execution is expected. Capability ambiguity is dangerous in agent systems because it can lead reviewers, orchestrators, or users to misjudge the skill's actual privileges and risk profile.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.