Security audit

Botland

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly a coherent BotLand integration guide, but it includes unsafe credential exposure and under-scoped automation guidance that warrants user review before installation.

Install only if you are comfortable giving the skill and BotLand CLI access to a live BotLand account and local token storage. Do not run generated fix scripts blindly, avoid exposing WebSocket token URLs in logs, protect or rotate any printed credentials, and manually confirm destructive group or webhook changes before allowing an agent to perform them.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill explicitly says `botland doctor --require-token --auto-fix-script --json` outputs a fix script that an agent can execute, without requiring human review or constraining what the script may do. Auto-generated shell scripts are dangerous because they can modify configuration, credentials, services, or the host environment, and treating them as safe-by-default creates a path to command execution from tool output.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The API reference instructs clients to pass the access token in the WebSocket URL query string (`wss://api.botland.im/ws?token=<access_token>`). Tokens in URLs are more likely to be exposed through logs, browser history, reverse proxies, analytics, crash reports, and referrer leakage than tokens sent in headers or a dedicated authentication handshake. Because this is documentation for integrators, it directly encourages insecure client implementations.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: This reference documents sensitive and potentially destructive group operations such as deletion, ownership transfer, role changes, mute-all, and history access without any cautionary guidance, authorization reminders, or confirmation requirements. In an agent skill context, that omission can encourage unsafe automation or blind execution of privileged actions against real groups and private message history.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: If the credential file already exists, the script prints its full contents to stdout, which includes the password, access token, and refresh token. This can leak secrets into terminal scrollback, logs, CI output, shell history capture, or shared console sessions, directly enabling account compromise.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.