Security audit

Agent Benchmark

Security checks across malware telemetry and agentic risk

Overview

This appears to be a legitimate agent benchmark, but it runs benchmark code directly on the host with broad access and weak containment.

Install only if you are comfortable running benchmark tasks in a disposable sandbox, VM, or container with no valuable files and no secrets in environment variables. Review task files before running them, avoid untrusted custom tasks, and do not run this in a normal workspace or CI environment that contains credentials.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: This file is explicitly designed to run task-supplied code by writing it to disk and executing it, while also inheriting the parent process environment and later writing a report to a path outside the immediate task workspace. In an agent skill context, task inputs should be treated as untrusted, so this creates a real code-execution boundary violation and can expose secrets or enable unintended filesystem access.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The summary explicitly highlights environment variable access as a successful capability but provides no warning that this can expose secrets such as API keys, tokens, or credentials. In a benchmark or agent-skill context, presenting this capability as a normal success metric without caution can normalize or encourage unsafe use of sensitive environment data.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The code writes attacker-controlled task.input.code and task.input.test_code into files and immediately executes them via spawn. Because the skill is an evaluation framework for arbitrary code, this is direct arbitrary code execution; a malicious task can read files, exfiltrate data, modify the workspace, or abuse the host unless strong isolation exists.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The subprocess environment is built from {...process.env, NODE_ENV: 'test'}, which exposes all parent environment variables to untrusted code. In CI/agent environments this commonly includes API keys, tokens, cloud credentials, and internal configuration, allowing straightforward secret theft and follow-on compromise.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The task explicitly reads `$env:COMPUTERNAME` and `$env:USERNAME` and prints them to output, which exposes host and user identifiers. While these are not secrets by themselves, they are environment-derived identifiers that can leak local system context to logs, benchmark harnesses, or remote observers and are not clearly disclosed in the task description.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: This benchmark file defines many executable PowerShell tasks, including filesystem writes, recursive file searches, environment-variable access, process inspection, temp-file creation, and background jobs, but provides no explicit trigger scope, sandboxing requirement, or execution constraints. In an agent-skill context, broad unconstrained actions increase the risk that a host system executes these scripts in an unintended environment, causing data exposure or unsafe system modification.

Ssd 3

Low

Confidence: 91% confidence
Finding: This task instructs the agent to access and display host/user environment identifiers, creating unnecessary disclosure of local system metadata. In an agent-evaluation context, even low-sensitivity identifiers can aid fingerprinting, correlation across runs, or unintended data collection when outputs are stored centrally.

VirusTotal

VirusTotal engine telemetry is currently stale for this artifact.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: index.js:89