Security audit

mycelium

Security checks across malware telemetry and agentic risk

Overview

This is a real collaboration-network skill, but it needs review because it can send task details to an external service and its safety gates are partly policy-based rather than technically enforced.

Install only if you are comfortable with Mycelium receiving task goals, summaries, feedback, and any context an agent passes to the SDK. Use a dedicated API key, keep MYCELIUM_API_URL pointed at a trusted endpoint, review every publish payload before confirming, and treat returned paths as untrusted suggestions rather than instructions to run automatically.

SkillSpector

By NVIDIA

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Context-Inappropriate Capability

Medium

Confidence: 86% confidence
Finding: The script automatically installs a package at runtime even though the skill's stated purpose is a pheromone-network interface, not package management. This creates an unnecessary capability to modify the host environment and introduces supply-chain and trust risks if package resolution is influenced by compromised indexes, mirrors, or local pip configuration.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: This is a real security-control mismatch: the code claims human review is required, but enforcement is only a caller-supplied boolean flag. Any agent or caller can set confirmed=True without proof of an actual user approval, which defeats the intended safeguard and can allow unauthorized publication of sensitive execution data to the external Mycelium service.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The publish() method only scrubs goal, path, and tags, while sending context and publisher_handle unsanitized to a remote API. In this skill's context, publish() is explicitly designed to share execution paths and strategic context externally, so leaving these fields unscrubbed creates a credible data-leak path for secrets, personal data, internal URLs, file paths, or other sensitive metadata.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The invocation text is broad enough to trigger on many ordinary planning or strategic tasks, which can route unrelated user work into a skill that contacts an external collaboration network. In this context that increases the chance of unnecessary activation and unintended disclosure of sensitive task context, especially because the skill encourages publishing summarized execution paths to a shared system.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The script modifies the Python environment by invoking pip without first obtaining explicit user approval. Silent environment changes can violate least surprise, bypass operator review, and increase the risk of unintended package installation or dependency conflicts on systems where this skill is evaluated or run.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.