Security audit

Github Collab

Security checks across malware telemetry and agentic risk

Overview

This skill matches its stated GitHub and agent-collaboration purpose, but it needs review because it can act through your GitHub login, control agent sessions, send data externally, and contains unsafe command and logging patterns.

Install only in a workspace and GitHub account where automated repo, issue, agent-session, and external-message actions are acceptable. Review destinations and repository names before use, avoid passing untrusted project data, and assume logs/databases may contain task text, session metadata, and message contents. VirusTotal was pending, so this verdict is based on artifact evidence rather than malware telemetry.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The module defines validateAgentAddress() but never enforces it in updateAgentAddress(), upsertAgent(), or batchUpdateAddresses(), so arbitrary target values can be persisted despite an apparent expectation of constrained qqbot addresses. If other parts of the system trust agent.target as a routing or integration endpoint, an attacker or buggy caller could store malformed or unexpected destinations, causing message misrouting, SSRF-like downstream behavior, or policy bypass depending on how targets are later consumed.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: When `enableLRU` is false, `_evict()` returns early and `set()` continues inserting new entries without enforcing `maxSize`, allowing unbounded growth of the backing `Map`. In any context where keys or insert volume can be influenced externally, this can be abused to cause memory exhaustion and denial of service.

Missing User Warnings

Medium

Confidence: 82% confidence
Finding: The README advertises powerful native capabilities to spawn, steer, kill subagents, send messages, and access session history, but does not communicate the security-sensitive nature of those operations. In an agent skill context, this can normalize dangerous cross-session or orchestration actions and increase the risk of misuse, over-privileged deployment, or unintended interference with other agents and sensitive conversation data.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The helper sends arbitrary messages and media to external channels via the built-in message() tool without any confirmation, allowlist, policy check, or user-facing disclosure that data is leaving the local/system boundary. In this skill's context, many higher-level wrappers can forward reports, files, images, audio, task details, and errors, so misuse could cause unintended data exfiltration to third-party messaging platforms.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The debug logger serializes and emits full tool parameters, which can include session keys, agent IDs, message content, targets, and other potentially sensitive data passed to sessions/message tooling. In an agent framework, logs are often aggregated, persisted, or viewed by operators, so this creates an unnecessary disclosure channel that can leak credentials, conversation contents, or operational metadata.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The batchUpdate implementation constructs SQL identifiers and parts of the query by directly interpolating table names, column names, and the id column into SQL strings. If any of those values can be influenced by untrusted input, this enables SQL injection in UPDATE statements, which can modify arbitrary data or execute unintended SQL depending on the driver/database configuration.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The script writes directories and files into a path derived from `process.cwd()` and `repoName` without any confirmation, dry-run mode, or safety checks. In an agent/automation context, this can cause unintended filesystem modification, overwriting expected workspace contents, or creation of artifacts in sensitive locations if the working directory is not what the user expects.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script invokes `gh repo create` and later creates issues through subprocess calls without an explicit confirmation gate. In a skill/agent setting, this can trigger unintended external side effects against the user's GitHub account, including creating repositories and issue spam under authenticated credentials.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The script interpolates an unvalidated `repoName` directly into shell commands passed to `execSync`, which invokes a shell. If an attacker can control `repoName`, they can inject shell metacharacters and execute arbitrary commands on the host running the script, not just query GitHub. In this skill context, the danger is increased because the code is presented as a utility/reporting script, so consumers may pass user-supplied repository names without realizing it becomes command execution.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: Repository names from projects.json are interpolated directly into shell commands executed with execSync. If an attacker can modify project data, they may inject shell metacharacters and achieve arbitrary command execution under the privileges of the user running the scheduler.

VirusTotal

60/60 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/scripts/main.js:28

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/scripts/progress-report.js:12

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/scripts/scheduler.js:45

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/tests/test-all.js:26