Nginx Config Creator

• Outcome: Review
• Latest audit: Jul 10, 2026 · 4:47 AM UTC
• Version: 0.1.1

Overview

The skill does what it claims, but it can change live Nginx configuration, reload a Dockerized server, and overwrite or delete config files with limited safeguards.

Install only if you are comfortable letting an agent write Nginx config files and reload a Docker container. Use a known-safe conf.d directory and container name, back up existing configs first, and avoid untrusted values for service name, domain, port, config path, or container name.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README describes a script that writes, tests, and may delete Nginx configuration files on the host, but it does not clearly warn users that running the skill changes live server configuration and can remove generated files during rollback. In an agent-executed context, this omission increases the chance of unsafe use, accidental production changes, or user misunderstanding about host-level side effects.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Features

- **Environment Awareness**: Simplifies commands by sourcing configuration from environment variables, falling back to command-line arguments.
- **Safety Fuse Mechanism**: The script performs a configuration test (`nginx -t`) before applying any changes. If the test fails, it automatically deletes the newly created config file (rolls back), ensuring the web server's stability is never compromised.
- **Stateless & Parametric**: Built for automation, receiving all necessary configuration via arguments or environment variables.

## Prerequisites (Recommended)

• Confidence: 80% confidence
• Finding: automatically delete

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.