Security audit

Find Everything

Security checks across malware telemetry and agentic risk

Overview

This is a real resource-search skill, but it also runs shell-based searches, can install found resources, and can persistently change its source registry with loose safeguards.

Install only if you are comfortable reviewing commands and installation prompts. Use explicit invocation, avoid untrusted or shell-special search text, manually confirm any install, and do not approve registry additions unless you trust the new source.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The skill goes beyond searching and recommending by supporting installation, deep scanning, and mutation of its own registry. Those are state-changing and potentially code-executing actions that substantially increase risk compared with a read-only search assistant, especially when bundled under broad activation conditions.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: Installing a package into a temporary directory as part of evaluating a search result causes untrusted third-party content to be fetched and potentially processed locally. For a search skill, that creates an unnecessary code supply-chain and prompt-injection surface, and can expose the environment to malicious package metadata, install hooks, or deceptive content.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: Allowing the skill to append newly discovered sites into its own registry changes future trust boundaries and search behavior. Even with user confirmation, a search skill should not be able to persistently expand its source set based on web-discovered content without a stronger review process, because this can introduce malicious or low-quality sources into later sessions.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The file implements a full local security-auditing capability, including inspection of file contents, credential paths, command patterns, obfuscation, and permission scope. In the context of a skill whose declared purpose is cross-platform resource discovery, this is unnecessary privileged functionality and materially expands the skill’s ability to inspect local data, increasing misuse and supply-chain risk.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: This code reads arbitrary local files and analyzes them for credentials, dangerous commands, exfiltration patterns, and shell/network permission indicators. For a search/orchestration skill, that creates an unjustified local inspection surface that could be repurposed to enumerate sensitive content or normalize broader host access under the guise of scanning.

Vague Triggers

High

Confidence: 94% confidence
Finding: The trigger phrases are broad enough to match ordinary conversation, increasing the chance the skill activates without the user intentionally invoking it. Because this skill can reach network, shell, local files, and later installation flows, accidental activation materially raises exposure and can lead to unwanted tool use or risky follow-on actions.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The automatic detection and proactive recommendation logic is underspecified, relying on vague heuristics like ongoing task context and missing tools. Ambiguous triggers are dangerous here because the skill can proactively engage and steer users toward external tools or higher-risk follow-up actions without a well-defined boundary.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The description does not clearly warn users that the skill may modify the local registry after confirmation. That omission weakens informed consent because users invoking a search tool may not anticipate persistent configuration changes affecting future behavior and trust decisions.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: references/security-checklist.md:11