Security audit

Bob P2P - Beta

Security checks across malware telemetry and agentic risk

Overview

This skill appears purpose-aligned for a paid Solana/P2P API marketplace, but it handles wallet secrets and real payments in ways users should review carefully before installing.

Install only if you are comfortable reviewing and trusting the client code, the cloned repository, and its providers. Use a dedicated low-balance Solana wallet, avoid entering a primary wallet seed phrase or private key, assume API requests and generated media prompts may leave your machine, and require a clear quote/confirmation path before allowing paid calls.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill instructs the user to run shell scripts and interact with external network services, but it does not declare corresponding permissions. This weakens user awareness and platform controls because the skill can cause code execution and outbound connections without an explicit permission boundary.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The result-fetch handler returns job status and final results for any caller that knows or guesses a jobId, but it does not verify that the requester is the original consumer or otherwise authorized. In a decentralized API marketplace, results may contain paid outputs or sensitive data, so this becomes an insecure direct object reference that enables unauthorized disclosure and result theft.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill states that API calls 'send $BOB payment automatically' and is tied to Solana mainnet, but the description does not prominently warn that using the skill can trigger real token transfers and blockchain fees. Users may invoke commands expecting a normal API call and unintentionally authorize irreversible financial actions.

Missing User Warnings

Medium

Confidence: 80% confidence
Finding: The manifest advertises external AI image generation but does not warn that user prompts are sent to a third-party provider and that outputs may be hosted externally. In an agent marketplace context, users may reasonably assume prompts stay within the Bob P2P ecosystem, so the omission can lead to unintended disclosure of sensitive or proprietary prompt content.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The video generation entry similarly omits notice that prompts are transmitted to an external service and that generated results are returned via hosted URLs. Because video generation prompts can contain sensitive business concepts, personal data, or confidential creative material, this lack of disclosure increases the risk of accidental third-party data exposure.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: The handler writes a file to /tmp using a path derived from jobId and does not clean it up after saveResult completes. In an agent or multi-tenant runtime, undisclosed local file creation can leak data to co-resident processes, accumulate sensitive artifacts, or cause disk exhaustion over time; the Bob P2P context makes this more concerning because the capability is unrelated and may not be expected or monitored.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The /results/:filename endpoint serves files directly from result storage with no authentication, authorization, or ownership check. In this P2P paid API marketplace context, result files may contain purchased outputs or sensitive artifacts, so any party who can guess or obtain a filename can download another user's data, bypassing payment and privacy controls.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The module can unilaterally construct and broadcast token transfers using a loaded private key without any explicit confirmation, policy check, or transaction preview. In the context of an agent marketplace skill that discovers, pays for, and calls third-party APIs, this increases the risk of unintended or malicious spending if upstream inputs, provider identities, or pricing data are manipulated.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The guide encourages exposing a provider on a public endpoint and automatically registering it with aggregators, but does not clearly warn that this makes the service discoverable and reachable by untrusted parties. In the context of a marketplace that executes provider-defined handlers and processes paid jobs, this omission increases the risk of unintended exposure, abuse, metadata leakage, and insecure deployment by users who may follow the instructions verbatim.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The script sends the user-provided body and selected API identifier to a remote provider endpoint via the Bob P2P client flow, and the skill description explicitly indicates this may trigger paid API usage using $BOB tokens. There is no explicit confirmation, cost warning, destination summary, or dry-run step before transmitting data to an external service, which creates a real risk of unintended data disclosure and unintended spend when users invoke the script with sensitive input or incorrect API selections.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script prompts for a wallet private key and writes it directly into a JSON config file under the user's home directory. This exposes highly sensitive Solana credentials at rest, and the input is also collected with a normal read prompt rather than hidden input, increasing risk of shoulder-surfing, terminal history/logging exposure, and compromise by any local process or backup system that can read the file.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The script interactively collects a Solana private key or mnemonic and writes it directly into config.json under the user's home directory in plaintext. This exposes the wallet secret to local compromise, backups, shell/session observation, accidental file sharing, and other processes or users with filesystem access; in the context of a cryptocurrency wallet, exposure can directly lead to irreversible theft of funds.

Session Persistence

Medium

Category: Rogue Agent
Content: This will: 1. Clone the bob-p2p-client repository 2. Install Node.js dependencies 3. Create config from template 4. Prompt you for wallet configuration ### Manual Setup
Confidence: 90% confidence
Finding: Create config from template 4. Prompt you for wallet configuration ### Manual Setup If you prefer manual setup: ```bash # Clone the client git clone https://github.com/anthropics/bob-p2p-client.git

Known Vulnerable Dependency: @libp2p/kad-dht==16.1.3 — 1 advisory(ies): CVE-2026-45783 (@libp2p/kad-dht: Unvalidated PUT_VALUE records allow unbounded disk exhaustion o)

High

Category: Supply Chain
Confidence: 91% confidence
Finding: @libp2p/kad-dht==16.1.3

Known Vulnerable Dependency: @solana/web3.js==1.87.6 — 1 advisory(ies): CVE-2024-30253 (Handling untrusted input can result in a crash, leading to loss of availability )

High

Category: Supply Chain
Confidence: 82% confidence
Finding: @solana/web3.js==1.87.6

Known Vulnerable Dependency: axios==1.6.0 — 10 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +7 more

High

Category: Supply Chain
Confidence: 89% confidence
Finding: axios==1.6.0

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.