Security audit

GitLab Agent Profile

Security checks across malware telemetry and agentic risk

Overview

The skill is not clearly malicious, but it can run on a schedule, use GitLab credentials, write generated files, and push repository changes with limited safeguards.

Install only in a dedicated profile repository with a least-privilege GitLab token, fixed output paths under the assets directory, and manual review or branch protection before pushing. Avoid enabling the cron until the schedule, output path containment, and converter dependencies are acceptable for your environment.

SkillSpector

By NVIDIA

Vulnerability Patterns

Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
Behavioral ASTexec() Call, eval() Call, Dynamic Import
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

subprocess module call

Medium

Category: Dangerous Code Execution
Content: webp_output.parent.mkdir(parents=True, exist_ok=True) magick = shutil.which("magick") if magick: subprocess.run([magick, str(svg_output), str(webp_output)], check=True) return convert = shutil.which("convert") if convert:
Confidence: 87% confidence
Finding: subprocess.run([magick, str(svg_output), str(webp_output)], check=True)

subprocess module call

Medium

Category: Dangerous Code Execution
Content: return convert = shutil.which("convert") if convert: subprocess.run([convert, str(svg_output), str(webp_output)], check=True) return npm = shutil.which("npm") if npm:
Confidence: 85% confidence
Finding: subprocess.run([convert, str(svg_output), str(webp_output)], check=True)

subprocess module call

Medium

Category: Dangerous Code Execution
Content: return npm = shutil.which("npm") if npm: subprocess.run( [ npm, "exec",
Confidence: 83% confidence
Finding: subprocess.run( [ npm, "exec", "--yes", "sharp-cli", "--", "--input",

Tainted flow: 'webp_output' from os.environ.get (line 345, credential/environment) → subprocess.run (code execution)

Medium

Category: Data Flow
Content: webp_output.parent.mkdir(parents=True, exist_ok=True) magick = shutil.which("magick") if magick: subprocess.run([magick, str(svg_output), str(webp_output)], check=True) return convert = shutil.which("convert") if convert:
Confidence: 93% confidence
Finding: subprocess.run([magick, str(svg_output), str(webp_output)], check=True)

Tainted flow: 'webp_output' from os.environ.get (line 345, credential/environment) → subprocess.run (code execution)

Medium

Category: Data Flow
Content: return convert = shutil.which("convert") if convert: subprocess.run([convert, str(svg_output), str(webp_output)], check=True) return npm = shutil.which("npm") if npm:
Confidence: 93% confidence
Finding: subprocess.run([convert, str(svg_output), str(webp_output)], check=True)

Tainted flow: 'webp_output' from os.environ.get (line 345, credential/environment) → subprocess.run (code execution)

Medium

Category: Data Flow
Content: return npm = shutil.which("npm") if npm: subprocess.run( [ npm, "exec",
Confidence: 92% confidence
Finding: subprocess.run( [ npm, "exec", "--yes", "sharp-cli", "--", "--input",

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill declares required binaries and a primary environment variable but does not explicitly declare the sensitive capabilities it uses, despite instructing execution of a helper script, network access to GitLab, file writes, and pushing changes. This creates a transparency and least-privilege problem: operators may authorize or schedule the skill without understanding that it can read secrets, modify repository contents, and publish changes remotely.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 89% confidence
Finding: The stated description frames the skill as maintaining a profile page and chart, but the instructions also entail live API access, identity discovery, collection of contribution metadata, generation of a detailed records dataset, and image conversion. That mismatch matters because users may underestimate the scope of data access and persistence, leading to overbroad trust or unsafe automation with a token that can read organizational activity and push results.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The daily routine explicitly tells the agent to commit and push changed assets, but does not prominently warn that this will modify and publish repository contents. In an automated or scheduled context, this can cause unintended writes, noisy commits, disclosure of generated data, or propagation of incorrect output if the helper script behaves unexpectedly or is tampered with.

Unvalidated Output Injection

High

Category: Output Handling
Content: webp_output.parent.mkdir(parents=True, exist_ok=True) magick = shutil.which("magick") if magick: subprocess.run([magick, str(svg_output), str(webp_output)], check=True) return convert = shutil.which("convert") if convert:
Confidence: 90% confidence
Finding: subprocess.run([magick, str(svg_output

Unvalidated Output Injection

High

Category: Output Handling
Content: return convert = shutil.which("convert") if convert: subprocess.run([convert, str(svg_output), str(webp_output)], check=True) return npm = shutil.which("npm") if npm:
Confidence: 89% confidence
Finding: subprocess.run([convert, str(svg_output

Unvalidated Output Injection

High

Category: Output Handling
Content: return npm = shutil.which("npm") if npm: subprocess.run( [ npm, "exec",
Confidence: 88% confidence
Finding: subprocess.run( [ npm, "exec", "--yes", "sharp-cli", "--", "--input", str(sv

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.