Secure Data Analyst Skill Suite

• Outcome: Review
• Latest audit: Aug 16, 2026 · 3:56 AM UTC
• Version: 1.1.2

Overview

This documentation-only skill fits its stated local data-analysis purpose, but its security promises are inconsistent around credential, script, and knowledge access.

Review this carefully before installing. It is not a hidden malware package based on the inspected artifacts, but only use it with trusted user-owned scripts, avoid storing highly sensitive secrets unless you understand MGC's actual data flow, and treat authorized knowledge retrieval as potentially visible to the AI session unless independently proven otherwise.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The document claims a 'zero-exposure' design where the AI cannot see credential content, but the provided code reads a local token, calls the sensitive retrieval API, parses the decrypted response, and returns credential material to the caller. In an agent skill context, this creates a direct path for agent-authored code to access secrets, undermining the stated trust boundary and increasing the risk of credential disclosure or misuse.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The mgc_find section presents a safer metadata-only discovery workflow, but it is contradicted by the earlier concrete pattern that shows direct token-file access and secret retrieval. This mismatch is dangerous because it may cause reviewers or users to believe the workflow preserves zero exposure when the included implementation actually enables direct secret access.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The document makes mutually incompatible security claims: it says the AI can read knowledge after authorization while also claiming the AI cannot see plaintext. If operators rely on the 'zero-exposure' wording, they may authorize retrieval of sensitive knowledge under a false assumption that the model never receives the content, when the `mgc_get` workflow strongly implies the content is returned for model use. In a prompt/skill suite about secure handling of sensitive knowledge, this misleading trust boundary is security-relevant.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: Labeling `mgc_get` as 'zero-exposure' while showing it as the method used to read knowledge content creates a deceptive security model. Users may approve access to credentials, business rules, or internal methodologies believing the AI will not receive the plaintext, but the example indicates the retrieved content is available for analysis. This can lead to unintended disclosure of sensitive knowledge into the model context.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The document says knowledge content is 'never exposed' but then describes the AI using retrieved knowledge content in analysis. That contradiction can cause users to store highly sensitive material under the mistaken belief that analysis use does not expose it to the model. In a skill explicitly marketed as secure knowledge management, overstating confidentiality materially increases the risk of accidental data leakage.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The trigger table allows activation by either the user or the agent for credential, script, and knowledge operations without defining strict preconditions, scoping, or approval flow. In an agentic environment, this ambiguity can let the model initiate sensitive workflows too readily, increasing the chance of unauthorized prompting, privilege overreach, or accidental invocation of protected operations.

Credential Access

High

• Category: Privilege Escalation

Content

| Document | Use Case | Triggered By |
|----------|----------|--------------|
| credential_management.md | Need to store or access credentials | User or Agent |
| script_management.md | Need to store or apply scripts | User or Agent |
| knowledge_management.md | Need to store or read knowledge | User or Agent |

• Confidence: 85% confidence
• Finding: The skill states that credential-management workflows may be triggered by the agent, and elsewhere says agents can read credentials after user authorization, creating an unsafe framing for credential access. Even if plaintext is supposedly hidden by MGC, allowing the agent to initiate credential-access flows broadens the attack surface for prompt-driven exfiltration attempts, confused-deputy behavior, or coercing users into approving unnecessary secret use.

Credential Access

High

• Category: Privilege Escalation

Content

# How to Call Credentials with Zero Exposure (Core)

Scripts can safely access credentials, but AI can never see credential content.

Below is the **standard zero-exposure credential call pattern** (pseudocode):

• Confidence: 95% confidence
• Finding: This section explicitly instructs how scripts should access credentials and frames it as a standard pattern. In a security-sensitive agent skill, guidance that enables agent-authored code to obtain secrets is dangerous because it normalizes privileged credential access and can be reused for unauthorized data access if authorization checks are bypassed or misunderstood.

Credential Access

High

• Category: Privilege Escalation

Content

# How to Write Scripts for Zero-Exposure Credential Calls

Scripts can safely access credentials, but AI can never see credential content.

Below is the **standard zero-exposure credential call pattern** (pseudocode):

• Confidence: 95% confidence
• Finding: This workflow explicitly enables scripts to retrieve credentials from a local store and use them during execution. Even if the AI does not directly view the secret, any script that can read credentials can misuse them to access external systems, perform unauthorized actions, or exfiltrate data if a malicious or tampered script is run.

Session Persistence

Medium

• Category: Rogue Agent

Content

---

# How to Write Scripts for Zero-Exposure Credential Calls

Scripts can safely access credentials, but AI can never see credential content.

• Confidence: 73% confidence
• Finding: The documented pattern relies on a persistent token stored in a predictable filesystem path and read by local scripts for later authenticated access. Persistent bearer tokens increase the blast radius of local compromise: any process or script with file access can reuse the token to retrieve protected material without an interactive re-authentication step.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: SKILL.md:22