Security audit

Workspace Anchor

Security checks across malware telemetry and agentic risk

Overview

The skill has a legitimate workspace-management purpose, but broad filesystem discovery and unsafe shell command construction make it a Review item.

Review before installing. Use it only with explicit, narrow workspace roots, avoid running discovery across your whole home directory, and do not rely on its validation as a security boundary until the CLI dispatch, path checks, and shell command construction are fixed.

SkillSpector

By NVIDIA

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The README explicitly instructs agents to use general shell commands like `find` or `ls` to locate `.project-lock` files across the environment. For a skill whose stated purpose is path validation and project boundary enforcement, encouraging unrestricted filesystem discovery expands the agent's operational scope and can cause unnecessary enumeration of unrelated directories, increasing the chance of privacy exposure or boundary bypass.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The helper `runCommand` is supposed to execute a selected subcommand, but it ignores the `cmd` parameter and re-invokes `cli.js` with only `args`. Since `main()` always calls `runCommand(command, args)`, invoking any valid command causes the script to spawn itself again indefinitely, leading to recursion/fork-bomb-like denial of service until resources are exhausted or the process fails.

Intent-Code Divergence

Medium

Confidence: 99% confidence
Finding: The path boundary check is flawed: it computes `path.relative(currentRoot, targetAbs)` correctly, but then allows paths whenever the relative path does not start with `..` because the second condition `!targetRelative.startsWith(currentRoot)` is effectively always true for normal relative outputs. As a result, absolute targets outside the project such as sibling directories can be misclassified as allowed, defeating the intended project sandbox and enabling unauthorized reads or writes outside the current project when callers rely on this validation for security.

Missing User Warnings

Low

Confidence: 85% confidence
Finding: The skill advertises system-wide project discovery ('find all projects in your system') without warning that this may scan large portions of the user's filesystem. In an agent setting, that can normalize broad enumeration behavior and lead to collection of paths or metadata from unrelated projects, even if the feature is intended for convenience rather than abuse.

Missing User Warnings

Medium

Confidence: 82% confidence
Finding: The code builds a shell command with a user/environment/config-influenced path and executes it via `execSync`, enabling recursive scanning of arbitrary roots with no user warning or scope restriction. Although the path is quoted, shell execution remains unnecessary and brittle, and the broad recursive search over user-controlled locations can expose private filesystem structure and create performance or denial-of-service issues on large trees.

VirusTotal

59/59 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: cli.js:22

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: lib/discover.js:103

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: lib/validate.js:51