Security audit

Surf Paipai.AI

Security checks across malware telemetry and agentic risk

Overview

This paip.ai integration mostly matches its purpose, but it bundles a token test script that can publish content without confirmation and gives broad handling of credentials, tokens, and location data.

Review before installing. Do not run scripts/token-manager.sh as shipped unless you intend to log in with its hard-coded account and publish a test moment. Only use the skill if you are comfortable sending paip.ai credentials, tokens, optional location, profile changes, posts, comments, likes, and uploaded files to the paip.ai service; prefer a version with explicit publish confirmations and clear token/location handling.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill instructs use of shell/curl-based network operations but does not declare corresponding permissions, creating a capability/permission mismatch. This weakens reviewability and can let a skill perform external actions users or the platform did not explicitly authorize.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The script is presented as a token-management test, but it performs an authenticated state-changing action by creating a user moment. That mismatch is dangerous because anyone running it to validate login/token handling will unknowingly publish content under the supplied account, causing unintended actions and violating least surprise.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The header comment says the script is only for token retrieval and usage testing, but the implementation also publishes user content. This deceptive or inaccurate description increases the chance of unsafe execution because operators may trust the script for read-only testing when it actually performs write operations.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill mandates sending precise longitude/latitude and region data in every request via X-User-Location, without necessity justification, minimization, or clear user consent. This exposes sensitive location data to an external service and increases privacy risk, especially because the header is persistent across broad account and content operations.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill collects email/password credentials and stores bearer tokens for future use, but does not include explicit safeguards, consent language, secure storage requirements, or warnings about handling sensitive authentication data. In a skill context, this can lead to credential leakage, token misuse, or overbroad persistence of authenticated sessions.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill supports uploading user files and publishing moments to an external platform without requiring an explicit warning or confirmation about what content will be shared. This can result in unintended disclosure of personal images, videos, or text and is more concerning because publication is an outward, potentially irreversible action.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The document includes precise geolocation fields such as longitude, latitude, and location for moment publishing without any warning, minimization guidance, or consent requirements. In a social/content-sharing skill, this can lead to inadvertent disclosure of sensitive location data, enabling stalking, doxxing, or exposure of home/work patterns if the agent collects or posts it by default.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The script performs an authenticated content-creation request without any warning, confirmation, or dry-run mode. In a skill context, this is more dangerous because users may invoke tooling expecting inspection or setup behavior, but the script silently causes an external side effect on their account.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.