Security audit

Komodo

Security checks across malware telemetry and agentic risk

Overview

This appears to be a legitimate Komodo infrastructure tool, but it can immediately change or delete live services with little safety friction.

Install only if you intend to let the agent administer a real Komodo environment. Use least-privilege, environment-scoped API keys, avoid uploading raw secret-filled env files unless intended, and require explicit human approval before deploy, stop, restart, delete, build, or procedure actions.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill clearly relies on sensitive environment variables, local file access for credentials or compose files, and network access to a privileged infrastructure API, yet it declares no explicit permissions or safety boundaries. This creates a capability-transparency gap that can lead to overprivileged execution and makes it easier for an agent or user to invoke powerful actions without understanding the full access being granted.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The help text documents many read and deployment operations but omits destructive commands that are actually implemented, such as delete-stack and stack-logs-related capabilities beyond the listed interface. In an agent skill context, undocumented destructive functionality increases the risk of accidental or misleading invocation because reviewers and operators may underestimate what the skill can do.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The activation text is broad enough to trigger on general 'server status,' 'container management,' 'deployments,' or 'builds' requests, which can cause the skill to be selected in many operational contexts. Because this skill includes remote control capabilities over infrastructure, broad invocation increases the chance of unintended use and escalation from informational requests to sensitive actions.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The documentation exposes multiple destructive or high-impact operations such as deploy, start, stop, restart, delete-stack, run-build, and run-procedure without warnings, approval requirements, or mention of production impact. In the context of an infrastructure-management skill, these commands can directly alter live services, cause downtime, or execute remote procedures, so omission of safety guidance materially increases operational risk.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The create-stack flow reads an optional env file and transmits its contents to the remote API as a newline-joined environment block, which may include secrets such as database passwords, tokens, or cloud credentials. In an infrastructure-management skill, silently forwarding local secret material to a remote service is sensitive and can cause unintended credential disclosure if users do not realize the env file is being uploaded.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The delete-stack command performs a destructive infrastructure action immediately with no confirmation prompt, dry-run, or safety interlock. In this skill's context, that is more dangerous because the tool is explicitly meant to manage production-like infrastructure, so a mistaken invocation could remove active services or configurations.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.