Minimal Agent

• Outcome: Review
• Latest audit: May 29, 2026 · 9:31 PM UTC
• Version: 1.0.0

Overview

This skill is a powerful system-control agent that openly supports arbitrary command execution and automatic fallback into that mode, so users should review it carefully before installing.

Install only if you intentionally want a high-privilege local automation agent. Prefer function or force_function mode, avoid auto and mixed mode on sensitive systems, verify the external system-controller dependency before use, and run it under a restricted account or sandbox where possible.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (12)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

try:
        # 执行任意命令
        result = subprocess.run(
            command_str,
            shell=True,
            capture_output=True,

• Confidence: 99% confidence
• Finding: result = subprocess.run( command_str, shell=True, capture_output=True, text=True, timeout=30, encoding="utf-8",

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 97% confidence
• Finding: The skill declares powerful shell-like capabilities and repeatedly states that in V1/text mode it can execute any system command, yet no explicit permission model is declared. This creates a capability/consent gap where a user or orchestrator may treat the skill as lower-risk than it actually is, increasing the chance of arbitrary command execution in an over-privileged context.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The description frames the skill as a system-controller-based Windows control agent, but the body expands behavior to unrestricted command execution, arbitrary scripts, file/network/database/system administration tasks, and automatic downgrade to unrestricted text mode when the safer controller is unavailable. That mismatch is dangerous because operators may authorize it for limited device automation while it actually functions as a general-purpose arbitrary execution agent.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill documentation claims constrained execution through system-controller, but the implementation silently includes unrestricted text mode and mixed-mode raw command execution. That mismatch is dangerous because users, reviewers, and policy layers may grant the skill more trust than its actual behavior deserves, enabling privilege expansion and misuse.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: Mixed mode broadens the skill from a bounded OS-control helper into a general automation/orchestration agent that can choose V1 raw commands for file and system administration tasks. This creates hidden capability expansion and makes policy enforcement harder because natural-language tasks can be transformed into unrestricted host actions.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The skill intentionally exposes unrestricted arbitrary shell command execution, which is far beyond what is justified for a system-controller-based helper. In this context, the capability is effectively equivalent to a remote shell and can be abused for full host compromise, destructive actions, or exfiltration.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The code comments assert that the script only acts as a thin executor for system-controller scripts, but the file also contains a general shell executor. This deceptive capability boundary increases the chance of unsafe approval and misuse because operators may treat the skill as narrowly scoped when it is not.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The trigger phrases are very broad and include common natural-language requests such as opening apps, screenshots, OCR, typing text, mouse actions, and hardware changes. In an agent-routing environment, broad triggers increase the probability of accidental invocation of a skill that can control the OS and, in some modes, execute arbitrary commands.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The skill advertises unrestricted command execution and high-risk administrative operations but does not provide a clear, consolidated warning that these actions can modify files, alter system state, access networks, and affect devices. In context, this is more dangerous because the skill is explicitly positioned as a general Windows control surface, so weak risk communication can lead to unsafe use in privileged environments.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The section describing 'any system command' normalizes arbitrary file, script, network, database, and system-management actions without sufficiently warning about their destructive and security implications. Because the skill also presents examples that directly encourage unrestricted command use, users may invoke highly privileged behaviors without understanding the attack surface or blast radius.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: In non-interactive text mode, the program executes raw shell commands directly from arguments without any warning or confirmation. That is especially dangerous for agent-driven invocation, where a model or chained tool can trigger destructive commands non-interactively and immediately.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: Mixed mode executes V1 steps through raw command execution without any warning, even though those steps are produced from natural-language task splitting. This allows seemingly benign multi-step requests to trigger arbitrary host commands silently, compounding the risk of prompt abuse or misclassification.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.