Security audit

skill-expert-skills

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed helper for creating and validating agent skills, with local file/script capabilities that fit its purpose and no evidence of hidden exfiltration or destructive behavior.

Install only if you want a skill-authoring assistant. Use it in a dedicated skills workspace, review generated or modified SKILL.md files before relying on them, avoid placing secrets or unrelated private files inside skill directories before packaging, and consider pinning dependencies if you run the helper scripts in a controlled environment.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Natural-Language Policy Violations

Medium

Confidence: 92% confidence
Finding: The file is entirely in Chinese and does not offer a language choice or explain a locale-specific constraint. In a general-purpose skill authoring workflow, this can cause users or downstream agents to misunderstand requirements, skip critical confirmation gates, or incorrectly implement the process, which undermines reliability and may indirectly affect security-sensitive skill creation.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: The file is entirely in Chinese and does not provide a language choice, translated summary, or documented locale constraint. In a broadly reusable agent skill, this can cause operators or downstream models to misunderstand safety requirements, workflow gates, or provenance obligations, increasing the chance of misuse or incorrect execution of security-relevant steps.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The template explicitly tells authors to use unspecified 'relevant keywords' as part of skill activation criteria, which encourages ambiguous matching and overbroad routing. In a skill-authoring guide, this is risky because it can propagate unsafe trigger design across many downstream skills, causing misactivation, context confusion, and unintended execution of unrelated instructions.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The full template repeats the same ambiguous activation pattern, normalizing vague keyword-based triggering in reusable scaffolding. Because this is a copy-paste template, the skill context makes it more dangerous: authors are likely to inherit the wording verbatim, multiplying accidental activations and making prompt routing less predictable across plugins.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The plugin Skill template uses trigger guidance like "do X", "create Y", "configure Z", or "mentions specific keywords," which is overly broad and ambiguous for dispatch logic. In an agent skill system, vague activation criteria can cause unintended skill invocation, leading the agent to apply the wrong workflow, tools, or permissions in response to unrelated user requests.

Ssd 3

Medium

Confidence: 88% confidence
Finding: The protocol requires confirmation contents to be recorded in a traceable way, and later sections define records that can include detailed user responses. In a skill-building workflow, users may paste sensitive requirements, credentials, internal paths, or proprietary content into these confirmations, creating unnecessary retention and increasing privacy and data-handling risk.

Ssd 3

Medium

Confidence: 97% confidence
Finding: This template explicitly tells the operator to preserve the user's original feedback verbatim, which can directly capture secrets, personal data, proprietary requirements, or other sensitive text. Because the skill is for creating and validating agent skills, users are especially likely to share internal prompts, file paths, validation output, or business context, making verbatim retention more dangerous in this context.

Unpinned Dependencies

Low

Category: Supply Chain
Content: PyYAML>=6.0
Confidence: 95% confidence
Finding: PyYAML>=6.0

Known Vulnerable Dependency: PyYAML — 8 advisory(ies): CVE-2019-20477 (Deserialization of Untrusted Data in PyYAML); CVE-2020-1747 (Improper Input Validation in PyYAML); CVE-2020-14343 (Improper Input Validation in PyYAML) +5 more

Critical

Category: Supply Chain
Confidence: 91% confidence
Finding: PyYAML

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.