Security audit
NPM Search
Security checks across malware telemetry and agentic risk
Overview
The skill appears to be a simple npm search helper, and the only concern is an unverified local helper script noted by telemetry rather than confirmed malicious behavior.
Before installing, check that the package actually includes `scripts/npmsearch` and skim it for unexpected file access, credential handling, or network calls outside npm/package metadata lookup. The available signals do not show malicious behavior, but the helper script should be visible and understandable because the skill asks the agent to execute it.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
65/65 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.