Writing Better Skills

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:19 PM UTC
• Version:
  1.0.0

Overview

This is a skill-authoring guide whose repository reads, local file creation, and validation scripts fit its stated purpose.

Before installing, understand that this skill may lead an agent to create or update project.skill.md in a repository and run included validation scripts while working on skills. Review generated local context files before relying on them, and do not place secrets or credential values in those files.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill instructs the agent to read project files, create or modify `project.skill.md`, and run validation scripts, which implies file read/write and shell capabilities. If those capabilities are not explicitly declared and constrained, downstream systems or reviewers may underestimate what the skill can do, increasing the chance of unintended file changes or command execution in a repository.

VirusTotal

66/66 vendors flagged this skill as clean.