Security audit

AgentOS Mesh

Security checks across malware telemetry and agentic risk

Overview

This is a real agent-messaging skill, but it needs review because it can expose mesh API credentials through an under-disclosed plaintext endpoint and status output.

Install only if you trust the AgentOS mesh server you configure. Set an explicit trusted HTTPS API URL, use a narrowly scoped API key, protect ~/.agentos-mesh.json with restrictive permissions, avoid sharing mesh status output, and enable cron or heartbeat polling only if you trust the mesh participants and accept the queue-clearing behavior.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The status command prints the first 20 characters of the API key to stdout. Even partial credential disclosure materially weakens secrecy because terminal output may be logged, shoulder-surfed, captured in screenshots, or exposed in CI/session transcripts, enabling correlation or brute-force reduction.

Intent-Code Divergence

Low

Confidence: 84% confidence
Finding: The comment and command description emphasize returning pending messages, but the implementation also clears the queue as a side effect. This can cause silent message loss or operational mistakes when users or downstream tools call the command expecting read-only behavior.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The documentation instructs users to store a live API key in a plaintext JSON file or environment variables and to use an unencrypted HTTP endpoint, but it provides no warning about file permissions, secret handling, shell history exposure, or TLS. This increases the likelihood of credential disclosure through local filesystem access, process/environment inspection, logs, or network interception, especially because the key appears to grant mesh access scopes.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: Pending-message processing deletes the local queue immediately after output with no warning, confirmation, or transactional safeguard. If processing fails downstream or the output is interrupted, messages may be irrecoverably lost, which is especially risky for agent coordination workflows.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The script reads a sensitive API key from configuration and later exposes part of it in the status command, creating a credential handling weakness. In an agent or CLI environment, status output is often copied into logs or support channels, increasing the chance of unauthorized disclosure.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.