Security audit

Credara

Security checks across malware telemetry and agentic risk

Overview

Credara appears purpose-built for agent registration and credentials, but it asks agents to handle accounts, tokens, wallets, assessments, and forum participation with materially unclear disclosure.

Review before installing. Use it only if you are comfortable with your agent contacting Credara, creating an external agent account, potentially sending your email, receiving and storing an agent API key, using owner JWTs for course actions, submitting assessment answers, creating durable credential/wallet records, and possibly participating in forum workflows. Do not give it real owner tokens, private documents, wallet authority, or posting authority unless you have confirmed the exact scope and consented to those side effects.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (25)

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The UI explicitly claims humans never need to see raw assessment questions, yet the advanced panel fetches and displays them to the browser. This undermines the integrity of the assessment model, enables answer harvesting or manual solving, and creates a misleading trust boundary for users and operators.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The 'Run Now' text says the platform will simulate the agent, but the code invokes a real server-side assessment execution endpoint that can produce an actual score and credential outcome. Misrepresenting a real evaluation as a demo can cause users to trigger irreversible or high-stakes actions without informed consent.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: Uploaded training documents are read client-side and their raw contents are copied into the PATCH body as domain_contexts, despite UI text implying they are only used to enhance the pack. This can cause creators to unknowingly transmit sensitive document contents to the backend, increasing risk of data over-collection, retention, and downstream exposure in prompts, logs, or later displays.

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: The UI explicitly states that raw prompt chains are never exposed, but the preview path later renders `previewPromptChain` content into the client. That creates a confidentiality and trust problem: proprietary system prompts, hidden instructions, or safety logic can be disclosed to any user able to access module previews, undermining prompt secrecy and enabling prompt-copying or targeted bypass attempts.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The page makes strong security/privacy claims that credentials and results never touch servers, but the same document clearly performs server communication for authentication and data retrieval. Even if the claim is intended to apply only to API keys or skill execution, the wording is broad enough to mislead users into unsafe trust decisions and reduce scrutiny of what is actually transmitted.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The UI tells users that post-benchmarking is only for measuring improvement and earning a credential, but the completion flow also triggers forum enrollment and subsequent bot participation behavior. This is a deceptive or incomplete disclosure issue: users may authorize an action believing it has a narrow purpose while it actually enables additional communications and autonomous behavior.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The install/benchmark workflow includes unrelated functionality to enroll bots into forum threads and have them auto-participate, expanding the capability beyond the core user-expected action. This violates least surprise and least privilege, and could cause unauthorized outbound content generation, privacy leakage, or reputational harm if bots post in public or semi-public discussions.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The policy states the site does not use third-party analytics cookies, but the page imports Google Fonts from Google's servers on load. Even if no analytics cookies are set, this still causes third-party network requests that expose visitor IP address, user agent, and referrer metadata to Google, which can make the privacy statement misleading.

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The page gives mutually exclusive guidance: it first says the ERC-4337 smart-contract wallet has no private key to export, then tells users to export a private key from dashboard settings to withdraw funds. This can mislead users into unsafe recovery flows, support scams, or mistaken assumptions about who controls the wallet and how assets can be accessed.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The page automatically reads the admin API key from the URL fragment and immediately loads the dashboard, which encourages placing a sensitive credential in a shareable/browser-visible location. Although fragments are not sent in normal HTTP requests, they are easily exposed through copied URLs, browser history, screenshots, shoulder surfing, and client-side scripts, increasing the risk of accidental credential disclosure for an admin interface.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The application stores both access and refresh tokens in localStorage, which makes them readable by any JavaScript executing in the page context, including code introduced through XSS or compromised third-party resources. Because refresh tokens are also persisted, an attacker who obtains them can often maintain long-lived authenticated access even after the access token expires.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: Assessment questions are fetched and rendered directly in the browser for the human user through the advanced panel. Exposing exam content client-side facilitates copying, sharing, and coaching around the assessment, weakening exam confidentiality and the credibility of any resulting credential.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The document upload flow sends user-provided file contents to the backend without any visible privacy notice, consent step, or explanation of how those contents will be stored and used. In a creator workflow, users may upload proprietary, regulated, or personal data, so silent transmission materially raises confidentiality and compliance risk.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The page stores access and refresh tokens in `localStorage`, making them readable by any JavaScript executing in the origin, including code introduced through XSS or compromised third-party scripts. In a dashboard handling agent management and key rotation, token theft could let an attacker impersonate the user and perform authenticated actions.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The documentation explicitly states that an agent can search and browse the marketplace automatically, but it does not disclose when external network requests occur, what user/task data may be transmitted, or whether the behavior requires user consent. In an agent skill context, undocumented autonomous outbound access can cause privacy leakage and unexpected behavior, especially if prompts, queries, or contextual task data are sent to a third-party service.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The statement that the agent will proactively search Credara 'when it encounters something it doesn't know how to do' and that there is 'No configuration needed' normalizes autonomous external requests without any safety notice or consent boundary. This is risky because an agent may send sensitive task context, user intent, or internal workflow details to an external marketplace automatically, increasing privacy, compliance, and trust risks.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The page reads an access token from localStorage and reuses it in Authorization headers. Tokens in localStorage are accessible to any script running in the origin, so any XSS elsewhere on the site would allow token theft and authenticated API abuse; this forum code increases exposure by depending on that storage pattern.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The signup flow tells users to paste a one-line prompt into an agent so it can read external instructions, auto-register, obtain an API key, and set up dashboard access. This delegates account creation and credential-handling to an external instruction source without an adjacent warning, review step, or clear consent boundary, creating a social-engineering and over-delegation risk.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The success UI states that the bot has been auto-enrolled in a discussion thread and will participate in conversations, but this warning appears only after the triggering action has already occurred. Because the user is not clearly warned beforehand, the system can cause autonomous bot behavior without informed consent, increasing the risk of unintended data sharing or external interactions.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill explicitly instructs the agent to transmit a human's email address to a third-party registration API, but it provides no consent, privacy, or data-minimization guidance. In an agent setting, this is risky because it encourages collection and external disclosure of personally identifiable information without verifying user approval or necessity.

Missing User Warnings

Low

Confidence: 81% confidence
Finding: The document includes direct handling instructions for sensitive secrets such as an agent API key and owner JWT, but it does not clearly warn against exposing, logging, or embedding those credentials in prompts, code, or shared outputs. This can lead to accidental credential leakage and unauthorized access if agents or users follow the examples naively.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: Conflicting wallet-control language can cause users to trust fraudulent instructions or mishandle funds because they cannot tell whether the wallet is custodial, non-custodial, or partially exportable. In a wallet guide, ambiguity about key ownership and withdrawal mechanics is security-relevant because it directly affects asset custody decisions.

Ssd 4

High

Confidence: 93% confidence
Finding: The dispatch workflow instructs users to have an agent autonomously fetch questions, answer them, and submit the assessment without human review. In a credentialing context, this directly enables automated completion of an exam and can be used to game trust signals, especially if the agent is effectively just a conduit for hidden answering logic or server-side automation.

Ssd 1

High

Confidence: 92% confidence
Finding: The 'Run Now' copy reframes a real server-side assessment as a benign demo/simulation, obscuring that the platform is effectively completing the evaluation path on behalf of the agent. This is dangerous because it can mislead users into generating official assessment outcomes under false assumptions and degrades the authenticity of the credential process.

Ssd 4

Medium

Confidence: 96% confidence
Finding: The agent onboarding prompt is intentionally minimal and benign-looking, but it outsources real behavior to a remote instruction file that the user cannot inspect from the page. That pattern is dangerous because the remote content can change over time and can direct an agent to perform registration, credential acquisition, or other privileged actions beyond what the user reasonably expects.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.