Security audit

JavaScript SDK工具

Security checks across malware telemetry and agentic risk

Overview

This skill appears to be an SDK usage guide, but it requests broad file and command authority without clear limits.

Review this skill before installing. It is not malicious from the inspected artifact, but grant it only in a workspace where running npm commands and editing project files is acceptable. Do not provide secrets, private code, regulated data, or production credentials unless you are comfortable with the external inference.sh/API workflow and have verified the SDK package and provider terms.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The skill advertises file processing and system command execution even though its core purpose is a JavaScript/TypeScript SDK for calling an external AI service. This capability expansion increases attack surface and can mislead users or agents into granting powerful local actions that are not necessary for the stated function, enabling unintended file access or command execution workflows.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The documentation recommends using environment variables for secrets, but the primary example hardcodes an API key in source code. Even as a placeholder, this normalizes insecure secret handling and can lead users to embed real credentials in code, where they may be committed to repositories, logged, or exposed to other tools.

Intent-Code Divergence

Low

Confidence: 82% confidence
Finding: The security section claims commands are limited to a whitelist and executed in a safe sandbox, but the skill provides no implementation details or constrained interface that enforces those controls. This creates a false sense of safety around a high-risk capability and may cause users to trust command execution that is actually unrestricted.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill exposes read/write and exec tools but does not prominently warn users up front that it can access files and run system commands. In agent settings, missing disclosure around side-effecting capabilities increases the risk of unsafe delegation, especially when users may assume the skill is only an SDK wrapper.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill description does not clearly warn that prompts and user data may be sent to an external AI service. Without explicit privacy disclosure, users may provide sensitive code, credentials, or documents under the mistaken assumption that processing is local, resulting in unintended third-party data exposure.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.