Security audit

驱动

Security checks across malware telemetry and agentic risk

Overview

This logo design skill is not outright malicious, but it asks for broad command and file access without clear limits.

Review this skill before installing. Use it only in a sandbox or trusted workspace, avoid giving it sensitive brand materials or API keys unless necessary, and require explicit approval before it runs commands, calls external services, or writes files.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The skill is marketed as a logo/brand identity generator, but its documentation and manifest expose broader capabilities including file I/O, API access, and command execution. This scope mismatch is dangerous because users or higher-level agents may invoke the skill under low-risk assumptions while it actually has materially more powerful behaviors.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: Documenting system command execution for a brand design skill introduces a powerful primitive unrelated to the stated business purpose. If an agent follows the skill literally, command execution could be abused for arbitrary local actions, environment discovery, or chaining with network/API features to exfiltrate data or alter files.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: Generic file read/write functionality is broader than what is necessary for generating brand guidelines and design concepts. In an agent setting, such permissions can enable unauthorized access to local data, overwriting user files, or using document outputs as a cover for unintended file-system operations.

Intent-Code Divergence

Medium

Confidence: 86% confidence
Finding: The skill presents itself early as a structured brand-asset generator, then later expands into a generic automation driver with file, API, and command execution features. This inconsistency increases the risk of deceptive or unsafe invocation because reviewers and orchestrators may underestimate the operational privileges granted to the skill.

Vague Triggers

Medium

Confidence: 78% confidence
Finding: Overly broad natural-language invocation guidance can cause accidental triggering in unrelated conversations. In a skill with read/write/exec capabilities, ambiguous activation is more dangerous because ordinary design discussion could unintentionally authorize privileged actions or tool use.

Vague Triggers

Medium

Confidence: 76% confidence
Finding: Encouraging casual phrases like iterative conversational requests without strict activation boundaries increases the chance of prompt collision with normal user dialogue. Given the skill’s broader documented capabilities, accidental activation could lead to unintended file, API, or command operations beyond harmless content generation.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.