Security audit

Agent优化专家

Security checks across malware telemetry and agentic risk

Overview

This maintenance skill is not malicious, but it asks for broad automated repair and self-update authority that should be reviewed before installation.

Install only if you want an agent-maintenance skill with access to inspect system state and propose or perform operational repairs. Before enabling it, disable automatic first-run checks, recurring cron/heartbeat repair paths, and weekly self-updates unless each change requires explicit approval and produces a reviewable diff. Treat file deletion, Docker pruning, service restarts, and sub-agent kills as manual-only actions after previewing the impact.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The skill includes a self-evolution workflow that performs external web searches for new 'best practices' and uses the results to update internal references. This expands the skill from local diagnosis/repair into unbounded external knowledge ingestion, increasing prompt-injection, supply-chain, and scope-creep risk because untrusted search results can influence future behavior.

Intent-Code Divergence

Medium

Confidence: 84% confidence
Finding: The skill claims it 'will not run by itself' while also documenting automatic first-load self-check behavior elsewhere. This contradiction can mislead users and orchestrators about when the skill may act autonomously, causing unexpected scans, state changes, or file creation without clear consent.

Intent-Code Divergence

Low

Confidence: 78% confidence
Finding: The safety section says some modifications require confirmation, but the first-run protocol mandates creating learnings/error-log.md automatically. Even though file creation is lower risk than core config changes, the policy mismatch weakens trust boundaries and normalizes unsolicited writes to the workspace.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The file defines a self-evolution workflow that goes beyond runtime diagnosis into autonomous maintenance of the skill's own knowledge base and documentation. This materially expands the skill's authority and behavior, creating a pathway for unreviewed changes to operational guidance that may later influence agent actions.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The workflow periodically gathers external trend data via web search even though the stated purpose is troubleshooting agent execution issues. This increases attack surface by importing untrusted external content into a self-modifying workflow, enabling poisoning, irrelevant drift, and policy bypass through externally sourced guidance.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The invocation guidance uses broad phrases such as system diagnosis, self-healing, optimization, and inspection, which can cause the skill to activate in loosely related situations. Over-broad triggering increases the chance that a high-privilege troubleshooting skill runs unnecessarily and performs sensitive checks or modifications outside the user's actual intent.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The manual trigger phrases are broad enough to match ordinary troubleshooting requests, which can cause the optimization skill to activate in situations the user did not specifically intend. In this skill's context, unintended activation matters because the skill is authorized to read logs, clean temporary files, retry operations, and propose repairs, increasing the chance of unnecessary privileged behavior or confusing workflow hijacking.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The template includes destructive maintenance commands such as deleting old files and pruning Docker resources without any explicit warning, confirmation step, backup guidance, or scope-limiting safeguards. In an agent-optimization skill, these commands are especially risky because an automated agent may execute them as routine remediation, causing data loss or removal of still-needed resources.

Missing User Warnings

Low

Confidence: 87% confidence
Finding: The guidance includes killing sub-agents and restarting gateways/services without prominent warnings about interruption, in-flight task loss, or service downtime. In this skill context, these are operationally sensitive actions likely to be used during automated self-healing, which makes unannounced disruption more dangerous.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The manual trigger phrase is broad and can be invoked without clearly constraining what files may be changed or what type of update is allowed. That ambiguity makes accidental or unexpected self-modification more likely, especially in a skill already designed to edit its own references and metadata.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The workflow instructs the agent to update reference files and SKILL.md but does not clearly warn users that persistent project files will be modified. Hidden write behavior reduces informed consent and can lead to integrity issues, especially when changes are triggered automatically by cron.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The workflow performs outbound search requests without disclosing that network access occurs or what data may be transmitted in queries. Even if requests go through localhost, the backend fans out to external engines, creating privacy, compliance, and data-exposure risk.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.