Security audit

file-browser-tool

Security checks across malware telemetry and agentic risk

Overview

This skill is advertised as a read-only file browser, but its own metadata and instructions also request command execution, write access, API use, credentials, and network-related behavior.

Review this carefully before installing. It may be intended as a file browsing helper, but the artifact asks for broader powers than that purpose needs. Only install it in an environment where shell execution, possible file writes, API credentials, and network/API handling are acceptable, or ask the publisher for a strictly read-only version with write and exec removed.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The manifest presents the skill as a safe, read-only workspace browser, but the declared tools and later documentation expand scope to write access, API integration, and command execution. This mismatch can mislead users or orchestration systems into granting or invoking capabilities that exceed the advertised trust boundary, enabling unsafe file modification or arbitrary command use under a benign label.

Intent-Code Divergence

High

Confidence: 95% confidence
Finding: The documentation repeatedly assures readers that the skill is read-only while also claiming support for file writing and command execution. Contradictory security claims are dangerous because operators may trust the safer description and approve the skill in contexts where write or shell access should never be allowed.

Intent-Code Divergence

Medium

Confidence: 84% confidence
Finding: These sections blur the boundary between local workspace reading and remote/API/network operations, which weakens the user's understanding of where data may flow. For a file-browsing skill, undocumented or unjustified network behavior increases the risk of unintended data exfiltration or policy bypass if sensitive file contents are sent externally.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: Requiring API keys and authenticated API usage is inconsistent with a local read-only file browser and suggests hidden or unnecessary external service interaction. That expands the attack surface by introducing secret handling, possible credential leakage, and potential transmission of local file data to remote systems without a clear need.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: System command execution is not justified by the stated purpose of safe read-only file browsing. Exec capability materially increases risk because a prompt, path, or wrapper mistake can turn a simple file viewer into an arbitrary command runner, enabling modification, data exposure, or broader host compromise.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The examples invoke shell commands like ls and cat without prominently warning that file access is being performed via command execution. Normalizing shell invocation under a 'safe file browser' description can cause agents or users to underestimate the risk of command execution pathways and expand acceptance of unsafe patterns.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.