Security audit

Singlefile Output Reference

Security checks across malware telemetry and agentic risk

Overview

This skill is mostly a reference library, but it can automatically add and load another skill when activated.

Review before installing. The markdown artifacts are coherent and static scan is clean, with VirusTotal still pending, but users should only install this version if they are comfortable with automatic universal-task-os installation/loading. A safer version would ask first, identify the exact dependency source and version, and keep read-only reference mode available by default.

SkillSpector

By NVIDIA

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The skill claims to be a reference-only library when UTOS is absent, yet its activation flow also says it will automatically install UTOS. That creates a hidden side effect during activation and undermines the user's ability to predict or consent to dependency changes, which is risky in an agent environment where skill loading can expand capabilities.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: A reference-library skill should not silently bootstrap another skill, especially one described as an execution orchestrator. This effectively turns a passive knowledge resource into a capability escalator, potentially introducing code-generation or execution behaviors beyond the user's expectation and the skill's stated role.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The manifest markets the skill as self-contained and zero-dependency, but the body states it requires and may install an external dependency. This mismatch is dangerous because users and policy systems may trust the manifest summary when deciding whether to load the skill, while the actual behavior expands the attack surface through undeclared dependency installation.

Intent-Code Divergence

High

Confidence: 88% confidence
Finding: The Python CLI section promises stdlib-only implementations, but later entries explicitly permit non-stdlib modules such as websockets, dnspython, and PIL. In a skill that is meant to generate runnable single-file tools, this inconsistency can cause downstream agents to produce code that pulls unvetted third-party packages, weakening supply-chain assumptions and breaking the stated trust boundary.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: The trigger list contains broad terms such as CLI, PPT, Bash script, calculator, and self-contained, which can match many normal conversations. Over-broad activation increases the chance this skill loads unintentionally, and because the skill also describes dependency installation and orchestration behavior, accidental activation becomes more security-relevant than it would be for a purely passive skill.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill documents automatic dependency installation without any user warning or approval. Silent installation prevents informed consent and can unexpectedly add new capabilities, trust relationships, or execution paths to the environment, which is especially risky for agent skills that may later handle code or operational tasks.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The usage rules instruct the skill to install UTOS on activation as part of normal operation, again without disclosing impact at the moment of use. Embedding silent installation into core workflow normalizes privileged side effects and makes it easy for users to trigger environment changes unintentionally.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.