Security audit

Python Toolkit Free

Security checks across malware telemetry and agentic risk

Overview

This Python guidance skill does not show malicious behavior, but it asks for broad write/exec authority and includes environment-changing examples without clear consent guardrails.

Install only if you are comfortable with a Python helper that may suggest or run write and command-line actions. Before using it, require explicit confirmation for package installs, environment creation, auto-fix formatters, file writes, deletes, or deployment-related work.

SkillSpector

By NVIDIA

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The skill is presented as Python coding-style guidance, but the documentation expands its capabilities into generic create/query/modify/delete/import/export/save operations via abstract parameters. That scope expansion can cause an agent to treat the skill as authorized for broader state-changing actions than users would reasonably expect, increasing the risk of unintended file or system modifications.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The trigger conditions say the skill should be used for broad development, debugging, testing, and deployment requests, which substantially exceeds the stated remit of Python style and best practices. In an agent environment, such broad routing language can cause inappropriate activation and tool use in higher-risk contexts, including execution paths that modify projects or environments.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The document says operations/deployment management is out of scope, but the trigger conditions later instruct the agent to use the skill for development deployment tasks. This contradiction undermines safety boundaries and can cause an agent to apply the skill in contexts where execution and system changes are more likely.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The auto-activation condition fires whenever requests mention common terms like Python or coding conventions, which are ubiquitous in normal development conversations. Overbroad activation increases the chance the skill will intercept unrelated tasks and steer the agent toward execution-enabled workflows or unsafe assumptions about its authority.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The trigger conditions use vague categories like coding assistance, debugging/testing, and development/deployment, which are broad enough to overlap with many unrelated tasks. In an agent system, ambiguity like this can lead to excessive invocation frequency and increased exposure to exec-capable behaviors outside the user’s intended scope.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill advertises modify/delete/save-style operations without warning users about possible data or system impact. When paired with write and exec tool permissions, that omission can cause users or upstream agents to underestimate the consequences of invoking the skill for state-changing tasks.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The documentation includes exec-based commands that install packages, create environments, and run auto-fix tools, but provides no warning that these commands can change the host system or project files. In an agent context, such examples can normalize unsafe execution and lead to unauthorized dependency changes, file rewrites, or environment drift.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.