Security audit

file-sender

Security checks across malware telemetry and agentic risk

Overview

This skill appears to be a legitimate file-delivery helper, but it can proactively package workspace files and send delivery metadata through a Manager service without an explicit per-send user confirmation.

Install only if you are comfortable with Manager-mediated file delivery. Before use, require the agent to show the exact path being packaged and get confirmation, avoid broad directories that may contain secrets, verify the Manager environment is trusted, and periodically clean `.file-outbox/` when deliveries contain sensitive material.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The script makes an authenticated outbound network request to a Manager service, which exceeds a purely local 'package and deliver local files' behavior as presented in the skill description. Even if the architecture intends this, it introduces a data egress path and trust dependency on a remote service that users are not clearly told about.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: Reading a service URL and bearer token from environment variables gives the script authenticated outbound communication capability. If those variables are misconfigured or attacker-controlled, the script could notify an unintended endpoint and leak file metadata plus a retrievable internal path.

Intent-Code Divergence

Low

Confidence: 85% confidence
Finding: Although the payload omits the file body, it discloses an absolute internal filesystem path that can aid later retrieval and reveal container layout. This weakens the claim of 'metadata only' and may expose sensitive implementation details to the remote service.

Vague Triggers

Medium

Confidence: 96% confidence
Finding: The skill tells the agent to proactively trigger file delivery even when the user did not explicitly request it. In this context, that is risky because the skill packages local workspace content, persists copies to disk, and initiates delivery via a manager service, increasing the chance of unintended disclosure of sensitive artifacts or intermediary files.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill emphasizes that files are 'safe' because they are persisted locally, but it does not clearly warn users that both the ZIP and a human-readable description are retained on disk in `.file-outbox/`. Persistent local copies can expose confidential content, filenames, and summaries to later processes, operators, or other components with filesystem access, and the description file may itself leak sensitive context.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The script sends file metadata to a remote service without a clear user-facing warning at the time of use. In a file-delivery skill, hidden network transmission is more sensitive because users may reasonably expect local packaging rather than backend reporting and later retrieval.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.