Security audit

internal-comms

Security checks across malware telemetry and agentic risk

Overview

This skill claims to help write internal communications, but its instructions also cover command execution, API credentials, file handling, and broad automation, so it needs review before installation.

Install only if you intentionally want a broad Development automation helper with command execution and API/file handling, not just an internal communications writing aid. Before use, require explicit confirmation for commands, credentials, external API calls, and file changes, and avoid granting elevated privileges or broad secrets until the skill is narrowed and documented.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The manifest frames the skill as an internal-communications writing aid, but the body expands it into development automation, data processing, orchestration, file/API operations, and operational execution. This scope mismatch is dangerous because users and the host agent may grant the skill trust, permissions, or automatic invocation appropriate for benign writing tasks while it actually advertises materially more powerful behavior.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: Granting exec capability to a skill whose stated purpose is drafting internal communications violates least privilege and creates a path to arbitrary local command execution. Even without explicit exploit strings in the document, this unjustified permission increases the blast radius of prompt injection, accidental invocation, or future implementation mistakes.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The skill describes API-key setup, external connectivity, and network-dependent operations that are unrelated to an internal-comms writing assistant. This can mislead users into exposing credentials or allowing outbound access under false expectations, increasing the risk of data leakage and unauthorized external interaction.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The documentation presents contradictory intent: the header markets internal-communications writing, while the body repeatedly describes development automation and data-processing operations. This inconsistency is dangerous because it obscures the real behavior of the skill and can cause inappropriate invocation, trust, and permission assignment.

Vague Triggers

High

Confidence: 95% confidence
Finding: The trigger condition states the skill should activate whenever the user needs related operations, which is overly broad and may cause unintended invocation. In the presence of exec, file, or network-related capabilities, accidental triggering materially increases the chance of unnecessary privileged actions or exposure of sensitive data.

Vague Triggers

High

Confidence: 94% confidence
Finding: The description uses broad language that overlaps with common user requests while also mixing in unrelated development automation scope. This increases the likelihood that the agent will invoke the skill in situations where the user only wanted text drafting, inadvertently exposing stronger capabilities than necessary.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill mentions API keys, file handling, environment setup, and command execution, but does not provide a clear user-facing warning about the operational and credential risks. This can cause users to supply secrets or approve actions without understanding that the skill may affect local systems or external services.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.