Security audit

Smart Update Agent

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed update-orchestration guide with broad but purpose-matched automation authority; users should configure its automatic updates and notification secrets carefully.

Install only if you want an agent to help manage skill/runtime updates. Keep dry-run and approval gates enabled for production, review any cron or auto-promote settings before activation, store webhook URLs in a proper secret manager rather than plain local files, and limit audit log retention and notification payloads to the minimum needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The skill claims no extra API key is needed, but later instructs operators to configure Slack/钉钉 webhooks and store credentials under a local path. This can mislead users about the presence and handling of sensitive secrets, increasing the chance that credentials are stored insecurely, disclosed in logs, or propagated through automation without appropriate safeguards.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The skill says its scope is limited to defined update capabilities, yet the error-handling section instructs users to perform broader network diagnostics such as ping and firewall/proxy checks. In a skill with exec capability, this scope expansion can normalize unrelated command execution and increase the chance of unsafe or unnecessary system/network probing beyond the user's intended task.

Vague Triggers

Medium

Confidence: 85% confidence
Finding: The activation examples are broad enough to trigger a high-privilege skill from vague requests like setting up automatic updates, without clearly defining prerequisites, targets, or safety gates. Because the skill has read/write/exec permissions and is designed to modify runtime and skill state, ambiguous invocation increases the risk of unintended execution and unauthorized changes.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill exposes exec and write capabilities that can modify system state, but the description does not prominently warn users that using the skill may change files, schedules, runtime versions, or deployed environments. In an update-orchestration context, this omission is especially dangerous because users may interpret the skill as informational while it is capable of making persistent and potentially disruptive changes.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The document introduces callback URLs, webhook notifications, and audit logs without warning that these mechanisms may transmit or store operational metadata, identifiers, versions, and other sensitive deployment details. In enterprise update workflows, this can lead to unintentional data exposure to third parties or excessive retention of sensitive audit content.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.