Security audit

auto-plantuml-edit

Security checks across malware telemetry and agentic risk

Overview

The skill is a legitimate PlantUML-to-PowerPoint converter, but it tells the agent to automatically download and later run an external Java JAR without user approval or integrity verification.

Review before installing. Prefer manually installing PlantUML, Java, and Inkscape from trusted sources, verify the PlantUML JAR checksum or signature, use a virtual environment with pinned dependencies, and run the skill only in a workspace where generated files and tool execution are acceptable.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill documentation directs the agent to read and write files, inspect environment-dependent tools, and execute shell commands, but it declares no permissions or safety boundaries. This creates a transparency and policy-enforcement gap: an orchestrator or user may invoke the skill without understanding that it can modify local files and run external programs.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The skill instructs the agent to automatically download and place an executable JAR into the skill directory from the internet. Even though PlantUML is relevant to the stated functionality, automatic retrieval of executable code without integrity verification, pinning safeguards beyond a URL, or user approval introduces a supply-chain risk and expands the agent's authority unnecessarily.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill instructs the agent to fetch and place an external executable artifact (a JAR) from the internet into the skill directory. Pulling binaries at runtime without signature verification, checksum validation, or explicit approval creates a supply-chain risk and can introduce untrusted code into the local environment.

Context-Inappropriate Capability

Low

Confidence: 88% confidence
Finding: The script trusts JAVA_HOME and INKSCAPE_PATH from the host environment to choose executables, which can cause execution of attacker-controlled binaries if the environment is manipulated. In agent or automation contexts, inherited environment variables are often less trustworthy, making this more dangerous than in a purely local interactive script.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill explicitly tells the AI to automatically download a JAR without first warning the user or asking for approval. Unprompted network retrieval of executable content is dangerous because it bypasses user intent, expands the attack surface, and may import tampered or unexpected artifacts.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.