Security audit

Agent防火墙免费版

Security checks across malware telemetry and agentic risk

Overview

This skill is not overtly malicious, but it asks for command-execution capability while making broader security claims than its simple local checks support.

Review this skill carefully before installing. It appears intended for local prompt and tool-call safety checks, but do not treat it as a complete firewall, vulnerability scanner, encryption protection tool, or reliable default-deny gate. If used, keep execution permissions narrow, avoid sending sensitive data through callback URLs, and require user confirmation before any command or tool execution.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Description-Behavior Mismatch

Medium

Confidence: 82% confidence
Finding: The skill is presented as a firewall for prompt injection, tool filtering, and input sanitization, but its trigger text expands scope to generic vulnerability scanning and encryption protection. This mismatch can cause the skill to be invoked for broader security tasks it likely cannot safely perform, leading to overtrust, misuse, or unsafe command execution under a misleading security label.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The documentation claims the free version is pure local processing and does not send data externally, yet the interface accepts a callback_url for asynchronous notification. This contradiction can mislead users into exposing sensitive prompts or results to external endpoints, violating privacy and security expectations.

Vague Triggers

Medium

Confidence: 78% confidence
Finding: The trigger conditions are broad enough to activate in many generic security-related conversations, not just when the firewall is actually needed. In an agent environment with exec capability, overbroad activation increases the chance of unintended command execution, tool interception, or user confusion about what actions are being taken.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The manifest advertises exec capability but does not prominently warn that shell or command execution may occur as part of operation. In a security-themed skill, users may assume analysis-only behavior; hidden execution capability raises the risk of unintended system interaction or abuse if the skill is triggered unexpectedly.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: references/detail.md:222

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: SKILL.md:83