MGC Blackbox — Multi‑Agent Secure Execution Engine

• Outcome: Review
• Latest audit: Aug 13, 2026 · 7:58 AM UTC
• Version: 1.4.10

Overview

This skill is a real local secret-and-script manager, but its documentation overstates the plaintext boundary while giving agents secret retrieval and script execution paths.

Review before installing. Use this only in a trusted local environment, treat `mgc_get` and the REST API as plaintext secret access, protect and permission the `~/.mgc` token file, and only allow agents to run scripts you explicitly trust.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The documentation makes a strong safety claim that AI can 'never read plaintext,' yet the same skill documents `mgc_get` and direct REST retrieval of decrypted content. This kind of contradiction is dangerous because users and agent builders may rely on a false trust boundary and grant the tool access assuming secrets cannot be exposed, when in fact they can be retrieved through documented interfaces.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The security model claims content never leaves the device in plaintext, but the REST API examples explicitly show returning decrypted secret values to callers. Even if bound to localhost, plaintext is still exposed across a process boundary, so the claim can mislead operators into overtrusting the system and enabling unsafe automation around secrets.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill explicitly enables stored script execution via `mgc_run` and says arguments are passed to `subprocess.run()`, but it does not foreground the risk that an agent may execute arbitrary or previously stored untrusted code. In the context of an agent skill, execution is especially dangerous because it normalizes hidden-script launching while emphasizing 'zero visibility,' reducing scrutiny of what actually runs.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The manifest explicitly markets the skill for storing tokens, passwords, and other sensitive credentials, but it provides no warning, constraints, or safety guidance about how those secrets are handled, who can invoke the exposed tools, or what trust boundaries apply. In a meta-skill that also exposes execution-related tools such as mgc_run, this omission increases the risk of users placing high-value secrets into a system without understanding possible misuse, leakage, or abuse paths.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

**What the AI does NOT see:**

- The script source.
- The API key retrieval logic (`os.environ["OPENAI_KEY"]`).
- How MGC encrypts or stores the data.

You maintain the script. AI drives it. Neither side exposes the other.

• Confidence: 86% confidence
• Finding: os.environ["OPENAI_KEY"]

Credential Access

High

• Category: Privilege Escalation

Content

import requests
import openai

# Read MGC access token (one-time; store outside any shared location)
with open(os.path.expanduser("~/.mgc/database/mgc_black_box/.mgc_token")) as f:
    MGC_TOKEN = f.read().strip()

• Confidence: 90% confidence
• Finding: access token

Credential Access

High

• Category: Privilege Escalation

Content

- Starts HTTP server at `http://127.0.0.1:57219`
- Initializes encrypted database on first run
- Generates access token at `~/.mgc/database/mgc_black_box/.mgc_token`

This token is required for all REST API calls.

• Confidence: 88% confidence
• Finding: access token

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.