Multi-Agent Safe-Cooperation (Single Device)

• Outcome: Review
• Latest audit: Jul 21, 2026 · 9:25 PM UTC
• Version: 1.0.0

Overview

The skill is coherent as an MGC multi-agent workflow, but it gives agents high-impact secret access and persistent-memory behavior with weak prompt-only controls.

Review this before installing. It may be suitable only if you trust the MGC setup, understand that generated scripts can retrieve local secrets, and are willing to manually approve any credential-backed, publishing, messaging, file-writing, or persistent-memory update. Avoid using it with highly sensitive accounts unless you add enforced tool scopes, logging, cleanup, and explicit approval gates.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (18)

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The document says plaintext retrieval via mgc_get requires user authorization, yet it simultaneously grants the Script Agent mgc_get capability in the role table. In a multi-agent setting, this contradiction weakens the claimed security boundary and can normalize agent access to sensitive plaintext, increasing the chance secrets or scripts are retrieved, exposed in context, or mishandled without explicit user approval.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The document explicitly instructs agents to record and retain user preferences across tasks, even though no narrow purpose, consent flow, retention limit, or minimization rule is defined. Persistent preference tracking can create unnecessary profiling and leak sensitive behavioral data into future task contexts or other agent operations.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The document states it is automatically maintained by a master agent to record best practices, common scripts, user preferences, and other collaboration information, creating broad persistent memory without a clearly scoped purpose. This encourages accumulation of cross-task data that may include sensitive information, operational details, or user history beyond what is necessary for a single interaction.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The prompt frames storage and handling as secure, but its own guidance instructs generated scripts to read a local authentication token and then use it to fetch secrets. That creates a misleading trust boundary: any generated script following this template can access sensitive credentials, which is more powerful than the role description implies.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The documentation says scripts only obtain credential references from MGC, but the provided implementation path reads an auth token from the filesystem first. This discrepancy hides the real mechanism and increases the risk that script generation is treated as low-risk when it actually enables authenticated secret retrieval.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: This skill gives a generic script-authoring agent a reusable recipe for extracting credentials from the local environment, despite its role being to write and store business scripts. In context, that is dangerous because it expands the agent's capability from code generation into secret access, enabling over-privileged scripts or abuse if task instructions are malicious or ambiguous.

Intent-Code Divergence

High

• Confidence: 95% confidence
• Finding: The template claims it returns credential metadata such as a name, but the later helper actually returns the underlying secret value from data_field. That mismatch can cause downstream agents or reviewers to underestimate exposure and approve scripts that in fact retrieve live credentials.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The README encourages automatic multi-agent task decomposition and execution through tools like mgc_run, but it does not include meaningful safety constraints, approval gates, or warnings about potentially system-impacting actions. In this context, agents are explicitly configured to invoke execution-capable tooling on the local device, so normalizing autonomous execution can lead to unsafe commands, misuse of stored scripts, or unintended operations against sensitive local resources.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The best-practice document is described as being automatically maintained and including collaboration records and user feedback, but the skill does not clearly warn users that potentially sensitive operational history may be stored. In this context, hidden retention of prompts, outputs, task metadata, or feedback can create an unintended privacy and data-minimization risk, especially when sensitive tasks are involved.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation exposes the local auth token path for the MGC API without an accompanying warning that it is a sensitive credential and must never be printed, shared, or passed to other agents. In a skill focused on multi-agent cooperation around sensitive resources, naming the token location can directly aid credential theft or prompt agents/users to surface the token into logs or model context.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The file describes ongoing storage of user preferences and collaboration data but provides no user-facing privacy disclosure, consent mechanism, or warning that information may persist across tasks. Users may reasonably assume ephemeral processing, so silent retention increases privacy risk and undermines informed consent.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The guidance instructs agents to save task results to files in a persistent directory and pass file paths between agents, but it does not warn that outputs may remain on disk and could contain sensitive data. This can expose confidential task results through leftover files, overly broad reuse, or later access by other processes or agents.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The prompt gives the Executor Agent broad authority to 'complete specific tasks' and 'call MGC scripts when needed' without defining strict task classes, approval gates, or allowlisted script boundaries. In a multi-agent setting, this can let an upstream agent smuggle unsafe, privacy-impacting, or unauthorized actions through seemingly normal task delegation, especially because the executor is instructed to operationalize tasks rather than challenge them.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The examples include actions like publishing content and sending email notifications, which can create external side effects and privacy impact, but the skill does not require prominent user-facing confirmation at the point of action. Relying on a general note about authorization is insufficient because an agent may proceed based on delegated instructions from the Master Agent, causing unintended disclosure, spam, or unauthorized publication.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The prompt explicitly instructs the agent to update a persistent best-practice document and potentially overwrite or save scripts via `mgc_save` after task completion, but it does not require explicit user consent or a clear disclosure that persistent state will be modified. This creates a memory/persistence poisoning risk: untrusted user input, derived preferences, or attacker-influenced scripts can be silently written into shared records and later affect future tasks.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The prompt recommends writing results to local files to preserve output, but it does not warn that results may contain secrets, tokens, personal data, or other sensitive material. In a script-generation context, that omission encourages persistent plaintext storage of potentially sensitive outputs in predictable locations.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The skill describes how to read a local token and transmit it in an HTTP request to retrieve sensitive credentials, but provides no warning, consent model, or restriction around this capability. That omission is dangerous because it normalizes silent credential access inside generated scripts and obscures the sensitivity of the operation.

Ssd 4

Medium

• Confidence: 95% confidence
• Finding: The manifest explicitly states that permission separation between agents is implemented only through prompt constraints rather than platform-enforced access controls. In a multi-agent system handling sensitive resources, prompt-only boundaries are weak and can be bypassed through prompt injection, role confusion, or task-chain manipulation, potentially exposing or misusing privileged capabilities.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.