Security audit

Docs Toolkit Free

Security checks across malware telemetry and agentic risk

Overview

This documentation skill is not clearly malicious, but it asks for broad command and file authority while giving vague instructions that include modify/delete operations beyond simple document lookup.

Install only if you are comfortable with an agent using local file search and occasional command-line tools for your documentation. Keep it pointed at a specific docs folder, avoid using callback URLs unless needed, and review any proposed modify/delete or shell command before allowing it to run.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The skill is presented as a documentation navigation/search toolkit, but the body expands its scope to generic create/query/export/modify/delete operations. This mismatch can cause an agent to invoke the skill for far broader tasks than users would expect, increasing the chance of unauthorized file or system changes under a benign-looking description.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The skill declares exec and CLI capabilities even though its stated purpose is documentation navigation and search, which are primarily read-oriented tasks. Unnecessary command execution materially increases attack surface because a loosely specified skill may cause an agent to run shell commands on local files or the environment without clear user awareness.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The invocation examples are broad natural-language requests like ordinary user questions, without clear boundaries for when the skill should activate. This ambiguity can lead an agent to over-trigger the skill and route unrelated prompts into a capability set that includes exec, creating unnecessary exposure to file and command actions.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The input schema accepts a generic free-form string plus broad options, making nearly any request appear valid for the skill. In combination with file-reading and exec capabilities, this lack of specificity raises the risk of misuse, prompt overreach, and accidental execution outside the intended documentation domain.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill advertises MD+EXEC and command-line use but provides no safety warning, permission model, or description of system impact. Users and agents may therefore treat shell execution as routine, despite the possibility of reading sensitive files, modifying the environment, or invoking external programs beyond the documentation task.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.