Security audit

Skill Security Scanner

Security checks across malware telemetry and agentic risk

Overview

The scanner mostly matches its stated purpose, but it has unsafe command handling and may expose scanned source code more automatically than its instructions promise.

Review before installing. Prefer invoking scripts/scan.sh directly with trusted, clearly typed targets, avoid passing untrusted or shell-like strings through the top-level index.js wrapper, and inspect any generated LLM prompt before letting an agent analyze it because it can include local source code. Use whitelist entries sparingly because they skip future scans by skill name.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Intent-Code Divergence

Low

Confidence: 79% confidence
Finding: Whitelist entries cause a skill name to bypass scanning entirely, and the script includes a built-in path to persist those trust decisions. In a security scanner, persistent allowlisting without strong provenance, audit trail, or expiration can let a malicious or later-compromised skill evade future analysis.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The skill defines very generic trigger phrases such as "detect [skill]", "is [skill] safe?", and "does [skill] have issues?", which are likely to match ordinary user conversation outside an explicit security-scanning intent. In an agent environment, overly broad activation can cause unintended invocation of this skill, leading to confusing behavior, incorrect tool routing, or interference with other skills.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The script automatically performs a network download and archive extraction before any substantive user warning or confirmation. In the context of a security scanner, silent remote retrieval increases attack surface, can surprise users in restricted environments, and may process untrusted archives without informed consent.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: Falling back to git clone means the tool spawns an external subprocess and performs additional network activity without clear user disclosure. For a scanner, undisclosed subprocess/network behavior is risky because it expands the tool's operational footprint beyond passive local analysis.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: index.js:8