Key‑Safe Skill Generator

• Outcome: Review
• Latest audit: Aug 20, 2026 · 2:28 AM UTC
• Version: 1.2.1

Overview

This skill is not clearly malicious, but it should go to Review because it teaches agents to run credential-using local scripts while framing itself as documentation-only and automatically safe.

Install only if you understand and trust MGC Blackbox and the local scripts it will run. Review any generated or stored script before mgc_run executes it, keep MGC token files protected, avoid logging or writing secrets to result files, and do not treat the documentation-only label as meaning the resulting workflows are low-risk.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The file claims to be documentation-only and safe for automatic approval, but it contains concrete operational guidance and code templates for retrieving credentials through a local HTTP API and executing stored scripts. That mismatch can cause reviewers or automated systems to under-classify the skill and approve a capability that enables sensitive secret-handling workflows.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The stated absence of a runtime entrypoint conflicts with repeated instructions to use mgc_run and local scripts as the effective execution path. This inconsistency can mislead security tooling and human reviewers into thinking the skill cannot drive execution when it clearly documents an executable workflow.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The manifest presents the skill as documentation-only and zero-exposure, yet it explicitly declares tooling such as mgc_run and mgc_open_webui that enable runtime execution and UI interaction. This mismatch can mislead reviewers and downstream agents into granting the skill more trust than warranted, reducing scrutiny around execution-capable workflows involving secrets and sealed scripts.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The security section asserts 'no_executable_code' while the rest of the manifest centers the design on mgc_run blackbox execution of local scripts. False security assertions are dangerous because policy engines, reviewers, or users may rely on them to permit installation or invocation, enabling execution paths under a misleadingly safe label.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The README promotes credential-handling and blackbox script execution workflows but does not clearly warn users about risks such as local script trust boundaries, unintended system actions, or privacy exposure through outputs and logs. In a skill specifically centered on secret management and execution, the lack of explicit cautionary guidance can mislead users into treating the workflow as inherently safe, increasing the chance of unsafe deployment or over-trust.

External Transmission

Medium

• Category: Data Exfiltration

Content

token = f.read().strip()
    url = f"{MGC_BASE_URL}/api/mgc/sensitive/get"
    headers = {"X-MGC-Token": token, "Content-Type": "application/json"}
    resp = requests.post(
        url,
        json={"info_type": info_type, "info_owner": info_owner, "action": "run"},
        headers=headers,

• Confidence: 88% confidence
• Finding: The embedded script instructs retrieval of sensitive credentials by reading a local token file and transmitting it to an HTTP API endpoint to fetch secrets at runtime. Even though the endpoint is localhost, this pattern creates a high-value secret access path that can be abused by generated skills, and the document normalizes direct secret retrieval logic in code templates.

External Transmission

Medium

• Category: Data Exfiltration

Content

token = f.read().strip()
    url = f"{MGC_BASE_URL}/api/mgc/sensitive/get"
    headers = {"X-MGC-Token": token, "Content-Type": "application/json"}
    resp = requests.post(
        url,
        json={"info_type": info_type, "info_owner": info_owner, "action": "run"},
        headers=headers,

• Confidence: 88% confidence
• Finding: The template section repeats the same sensitive pattern: reading a local MGC token and calling an HTTP endpoint to obtain credentials. Reusable templates materially increase the chance that downstream generated skills will copy this design without additional hardening, expanding the attack surface for local secret access.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:449