Security audit

自主决策代理

Security checks across malware telemetry and agentic risk

Overview

This decision-support skill is mostly local, but it has inconsistent network/API-key documentation and writes persistent decision memory, so users should review it before installing.

Install only if you are comfortable with the agent creating a ./decision-making/ folder and storing decision history locally. Avoid putting secrets, customer data, or sensitive third-party information into decision records, and treat the callback_url/API_KEY sections as unresolved documentation problems until the publisher clarifies whether any network callback or credential is actually required.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The skill claims it is fully local and never accesses external systems, yet it documents a callback_url for asynchronous notifications. That mismatch can mislead users and integrators into approving or running the skill under a false trust model, potentially enabling unexpected outbound data transmission if implemented.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The file says no credentials are needed, but later requires API key configuration. This contradiction can cause users to underestimate secret-handling requirements, increasing the chance of unsafe setup, accidental key exposure, or deployment in environments where network/API use was not expected.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The documentation makes conflicting claims about network and external-system usage, including statements that it is local-only alongside callback/API-key related behavior. Security decisions depend on accurate capability disclosure, and these contradictions undermine informed consent, risk review, and sandboxing assumptions.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The review trigger phrase ('that decision was right/wrong') is broad and can be matched accidentally in ordinary conversation. In a skill with persistent memory and write capability, unintended activation can create or modify stored decision records without clear user intent.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill instructs persistent local storage of user preferences and decision records but does not present a clear user-facing warning about the side effects of saving data to disk. This can lead to retention of sensitive personal or business decision context on the filesystem without informed consent or awareness of where data is stored.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The initialization step creates directories and files on the local filesystem automatically, but the document does not clearly warn users about these changes before they occur. Silent filesystem modification is risky in agent contexts because it can persist user data, clutter repositories, or write into sensitive working directories unexpectedly.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.