Security audit

Decision Architect

Security checks across malware telemetry and agentic risk

Overview

The skill is not malicious, but it needs review because it tells the agent to create lasting local decision-memory files while declaring only read access.

Install only if you are comfortable with the agent maintaining a local decision journal and preference profile. Before use, require an explicit storage location, ask for confirmation before writing decision records or memory updates, and avoid putting credentials, medical/legal details, or third-party sensitive information into decisions that may be saved.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The manifest declares only `read` capability, but the skill description and body clearly instruct the agent to persist decision logs, profiles, heartbeat state, and reversal records. This creates a permission/behavior mismatch that can mislead operators and policy engines, enabling unauthorized local state creation or mutation if the host agent follows the prose instead of the manifest.

Scope Creep

Critical

Confidence: 99% confidence
Finding: The workflow explicitly requires writes such as '先写入 decisions/ 再输出结论' and ongoing mutation of memory files, which exceeds the declared `read` permission. In an agent ecosystem, this kind of under-declared side effect is dangerous because it can bypass trust assumptions, cause unauthorized persistence of user data, and break sandbox or approval models built around the manifest.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The file claims the skill is '纯 Markdown 指令驱动' and framed as effectively read-driven, yet elsewhere mandates durable local file writes and state management. This inconsistency increases the risk of deceptive deployment and accidental overtrust: users may enable the skill believing it has no side effects, while it actually accumulates and mutates local decision history.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.