Security audit

Pocketalert

Security checks across malware telemetry and agentic risk

Overview

This appears to be a real Pocket Alert integration, but it gives agents broad account-management and configuration powers beyond simple push notifications.

Install only if you want agents to have more than simple notification-sending access to Pocket Alert. Use a least-privilege API key if available, verify the CLI download source, avoid sending secrets or sensitive operational data in messages, and require explicit human approval before delete, API-key, or base-URL configuration commands are run.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The skill is presented as a push-notification integration, but its documentation exposes substantially broader administrative capabilities, including listing resources, creating and deleting applications, devices, webhooks, viewing API keys, and changing configuration. In an agentic context, this expands the available action surface beyond the stated purpose and can enable unintended inventory disclosure, service reconfiguration, or destructive actions if an agent uses the skill too broadly or under prompt influence.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The skill includes commands to set a new API key and override the base URL, which are powerful local reconfiguration capabilities not necessary for ordinary notification sending. In an agent environment, these commands could redirect traffic to attacker-controlled infrastructure, swap credentials, or persistently alter future behavior, making the skill materially more dangerous than its description suggests.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The documentation includes delete commands for applications, devices, and webhooks without any caution, confirmation guidance, or explanation of consequences. In practice, this can normalize destructive actions for agents or operators and increase the likelihood of accidental or prompt-induced deletion of production resources.

Missing User Warnings

Medium

Confidence: 80% confidence
Finding: The skill shows API key authentication usage directly in examples without any warning about secret handling, shell history exposure, or least-privilege concerns. In agent and CI environments, this can lead to credential leakage through logs, transcripts, command history, or unsafe reuse of highly privileged keys.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The webhook examples encourage embedding arbitrary incoming payload fields into push messages, which can propagate sensitive repository, commit, or user data to mobile devices without any privacy warning or filtering guidance. In some deployments, this may leak confidential metadata or message content to unintended recipients or lock-screen notifications.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.