Auto Skill Evolver

• Outcome: Pass
• Latest audit: May 29, 2026 · 8:19 PM UTC
• Version: 1.5.1

Overview

This skill can run user-chosen commands and propose changes to other skills, but that behavior is clearly disclosed, purpose-aligned, and gated before applying edits.

Install only if you intentionally want a tool that can run local training commands and modify skill files after approval. Use it in a development workspace, review the full diff before applying, prefer hash approval over a plain yes token, restrict --allowed-skill-roots, and avoid traces or feedback that contain credentials or sensitive private data.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

args = parse_safe_command(command)
    print(f"Executing (safe argv): {args}")
    try:
        result = subprocess.run(args, shell=False, check=True, capture_output=True, text=True)
        return result.stdout, result.stderr
    except subprocess.CalledProcessError as e:
        print(f"Command failed with error: {e}")

• Confidence: 92% confidence
• Finding: This code executes a user-supplied command via subprocess.run. Although shell=False and token filtering reduce classic shell-injection risk, the script still permits arbitrary executable invocation, so an attacker who controls --command can run any local program with the privileges of this process. In a meta-skill that automatically trains and evolves other skills, that capability is especially dangerous because the workflow is explicitly designed to execute agent/task commands repeatedly and with little friction.

Tainted flow: 'username' from os.environ.get (line 117, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow

Content

# 1. Break inheritance and remove existing permissions
                subprocess.run(['icacls', path, '/inheritance:r'], check=True, capture_output=True)
                # 2. Grant full control to current user
                subprocess.run(['icacls', path, '/grant:r', f'{username}:(OI)(CI)F'], check=True, capture_output=True)
                
        else:
            # Linux/Mac: chmod 700 (rwx------)

• Confidence: 78% confidence
• Finding: The code trusts the USERNAME environment variable to decide which Windows principal receives Full Control on the protected directory. In hostile or unusual execution environments, a manipulated environment variable could cause ACLs to be granted to the wrong account, weakening confidentiality of sensitive workspace contents.

Tainted flow: 'username' from os.environ.get (line 117, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow

Content

username = os.environ.get("USERNAME")
            if username and os.path.exists(path):
                subprocess.run(["icacls", path, "/inheritance:r"], check=True, capture_output=True)
                subprocess.run(["icacls", path, "/grant:r", f"{username}:F"], check=True, capture_output=True)
        else:
            if os.path.exists(path):
                os.chmod(path, 0o600)

• Confidence: 78% confidence
• Finding: As with the directory case, this file-permission routine grants access based on an environment-derived username rather than a trusted OS identity source. If that value is spoofed, sensitive files may end up readable or writable by an unintended account.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The script reads an execution trace file or falls back to stdout/stderr, then persists that data for downstream optimization without any user-facing warning, consent step, or sanitization. Execution traces commonly contain prompts, credentials, file paths, tokens, personal data, or proprietary content, so this creates a meaningful sensitive-data exposure risk in a self-training pipeline.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.