Self-Repair System — Autonomous AI Automation

• Outcome: Review
• Latest audit: May 29, 2026 · 9:24 PM UTC
• Version: 1.3.0

Overview

This skill is a real self-repair utility, but it exposes broad automatic file, process, command, network, LLM, and scheduling powers without enough scoping or user control.

Install only if you explicitly want autonomous local repair behavior. Before enabling hub mode, restrict workspacePath, backupPaths, requiredFiles, and requiredDirs; remove or hard-gate runCommand, killProcess, generic HTTP checks, ask/smartAsk, and arbitrary scheduled callbacks; keep independent backups; and avoid exposing this skill to untrusted prompts or configuration.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence
• Finding: The metadata and description present the skill as a narrow self-repair utility, but the documented behavior includes broad capabilities such as arbitrary LLM prompting, routine scheduling, custom routine execution, and generic process management. This scope mismatch is dangerous because it can cause users or downstream systems to grant trust and permissions appropriate for diagnostics while the skill can perform far more powerful actions affecting processes, commands, and system behavior.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The hub exposes a general-purpose `ask`/`smartAsk` interface that can send arbitrary prompts to an LLM, which materially expands the capability of a skill described as workspace self-repair. In a self-repair context, this broad prompt execution surface is dangerous because other components can route sensitive workspace content or operational instructions to the model without clear scope limits, creating an unnecessary data exposure and misuse channel.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: `ask(prompt, model)` accepts arbitrary caller-controlled text and model selection even though the stated purpose is automated repair of Ollama, configs, and files. This is dangerous because it turns the skill into a reusable LLM execution primitive that can be repurposed for unrelated actions, including sending sensitive internal data to the model service or enabling prompt-driven workflows outside the declared trust boundary.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The module exposes a generic process-killing primitive that can terminate arbitrary processes by name, which exceeds the stated Ollama/workspace repair scope. On Unix it uses `pkill -f`, which matches against full command lines and can kill unintended processes if this method is reachable with attacker-controlled or overly broad input.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: `runCommand()` provides arbitrary process execution from a free-form command string, which is far broader than the declared self-repair purpose. Although it blocks common shell metacharacters and uses `shell:false`, an attacker who can influence the command can still execute arbitrary local binaries and arguments, leading to code execution, system modification, or data access.

Context-Inappropriate Capability

Medium

• Confidence: 85% confidence
• Finding: `checkHTTPService(host, port, path_url)` allows probing arbitrary hosts and paths rather than only localhost Ollama health endpoints. In an agent context, that creates a network-capable primitive that can be repurposed for internal network scanning, service discovery, or policy bypass beyond the advertised functionality.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The documentation explicitly claims network access is limited to localhost Ollama checks, but the implementation includes a generic HTTP request helper for arbitrary destinations. This mismatch is security-relevant because it can mislead reviewers and downstream systems into granting trust or permissions that the code does not deserve.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The README promotes automatic repair actions such as restarting services, restoring files from backups, and replacing corrupted configs without prominently warning that these actions can be destructive or alter system state. In a self-repair/orchestration skill, understated documentation of autonomous recovery behavior increases the risk of unsafe deployment, accidental overwrites, and recovery from attacker-controlled backups or paths.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: Advertising automatic repair and restart behavior without warning that the skill may modify files, configs, or running services creates unsafe expectations and undermines informed consent. In a security-sensitive workspace, users may invoke it assuming read-only diagnostics, while it can change system state or disrupt services.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The summary text promotes auto-healing for configs and files without disclosing the possibility of destructive, irreversible, or incorrect repairs. Because the skill context specifically involves automated changes to files and service state, the absence of warnings makes accidental misuse more dangerous rather than less.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: `start()` immediately runs `fullRepairCycle()` and continues doing so on a timer without any confirmation, dry-run mode, or warning to the user. In a file/config repair tool, unattended modification of the workspace can overwrite valid state, restore from untrusted backups, or repeatedly make harmful changes if the repair logic is wrong or influenced by bad inputs.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The code posts prompt content over plain HTTP to the configured Ollama endpoint with no user-facing disclosure and no transport security. If `ollamaHost` or port are redirected off-host or traffic traverses a network namespace/proxy, prompt contents may be exposed in transit, and users are not warned that their data is being transmitted to another service.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The skill can forcibly terminate processes without any user-facing disclosure, confirmation, or visible audit gating. In a self-repair tool this is risky because it can disrupt unrelated workloads, cause denial of service, and make destructive actions hard for users to anticipate or control.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The workspace and config repair paths perform file creation and overwrite operations automatically, including restoring files from backup locations and rewriting configs, without user-facing notice or confirmation. In an agent skill this can silently alter project state, replace legitimate files with stale or attacker-controlled backups, and destroy local changes.

VirusTotal

63/63 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: src/self-repair.js:9