Security audit

Skill Creator

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly aligned with creating and evaluating skills, but it has under-disclosed local side effects that deserve review before installation.

Install only if you are comfortable with a skill that edits skill files, runs bundled Python helpers, spawns evaluations, and writes local workspaces. Use a dedicated workspace without secrets, prefer the static viewer or an unused port, inspect generated trigger descriptions before keeping them, and avoid enabling verbose/result logs for sensitive prompts or proprietary skill content.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The script enumerates any process bound to the requested port and sends SIGTERM before attempting to start its own server, with no ownership check or confirmation. That can disrupt unrelated local services or developer workflows and is broader authority than needed for an eval viewer, making the skill context increase concern rather than reduce it.

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: The top-level description says the script generates and serves a review page, but omits that it may terminate existing processes on the selected port. This mismatch hides a destructive side effect from operators, increasing the chance of accidental service disruption.

Vague Triggers

High

Confidence: 95% confidence
Finding: The skill explicitly tells the author to make descriptions 'pushy' and to trigger even when the user does not explicitly ask for the skill. That encourages overbroad activation and skill collisions, increasing the likelihood that this powerful skill will run in unrelated contexts and perform shell/filesystem actions the user did not intend.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The instructions direct the agent to create directories, copy skill trees, write metadata, run Python modules, and otherwise modify the local filesystem, but they do not require informing the user or obtaining consent before these actions. In practice this can lead to unexpected writes, snapshots of sensitive content, and local process/file clutter during ordinary use of the skill.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: This file defines two materially different operating modes—post-hoc comparison analysis and benchmark-results analysis—but never states a strict selector or precedence rule for choosing between them. In an agent setting, that ambiguity can cause the analyzer to read the wrong inputs, emit the wrong output schema, or mix behaviors across modes, leading to incorrect file access and unreliable analysis results.

Missing User Warnings

Low

Confidence: 95% confidence
Finding: The skill explicitly instructs the agent to read files or directories from arbitrary provided paths and later write a JSON result file, but it does not constrain those paths to a safe workspace or warn about filesystem side effects. In an agent environment, this can enable unintended access to sensitive local files or overwriting/creating files in unexpected locations if an attacker controls the input paths.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The main flow calls _kill_port(port) automatically before binding, without prompting the user that an unrelated process may be terminated. In practice this can unexpectedly stop other local applications, which is destructive behavior not adequately signaled by the interface.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.