Security audit

GTM Tools

Security checks across malware telemetry and agentic risk

Overview

This skill is a real GTM API integration, but it gives agents broad account, billing, social-media, and session-backed authority without enough consent and scoping safeguards.

Review this skill carefully before installing. Only use it when you intentionally want an agent connected to gtm-tools, and require confirmation before account creation, extension installation, buying tokens, enabling auto-reload, revoking keys, reading inboxes/conversations/saved items, sending messages, posting, voting, or using logged-in LinkedIn/Reddit sessions.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The skill’s invocation guidance is very broad and can cause the agent to load this capability for generic setup, authorization, or tool-name mentions without first confirming user intent. In context, that increases the chance of unnecessary external-account onboarding, token purchasing paths, or session/extension setup being suggested in situations where the user did not explicitly ask to connect a third-party service.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The autonomous self-registration flow creates an external workspace and API credential with no prominent requirement to obtain user consent first. In an agent context, this can lead to silent creation of third-party accounts or identities, unexpected data sharing, and persistence of credentials tied to a service the user did not knowingly join.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The extension install command pipes a remote shell script directly into bash and is presented as a routine setup step without a warning about modifying the local environment. This is risky because it executes unreviewed code from a network location, potentially changing browser, system, or session state and expanding trust to the remote host.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The catalog includes billing and account-modifying actions such as buying tokens, enabling auto-reload, revoking API keys, and accessing billing portals, but it does not warn that these operations can spend money or alter account state. In an agent context, omission of consent and confirmation guidance is dangerous because an automated system may invoke these tools without explicit user approval, causing financial loss or unwanted account changes.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The tool list exposes functions that retrieve or act on personal and sensitive data, including professional emails, direct messages, inbox content, saved posts, conversations, and user account details, without any privacy or authorization warning. In an agent skill, this increases the risk of unauthorized collection, review, or transmission of personal data and may lead to privacy violations or compliance issues.

Unrestricted Tool Access

Medium

Category: Excessive Agency
Content: Each `ready` row carries a `linkedin_username` / `reddit_username` — pass it as `senderUsername` to write tools. Both tools cost 0, so checking is always free. ## How to call any tool Every tool is the same shape. Tool name in the path, JSON body, bearer header:
Confidence: 80% confidence
Finding: call any tool

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.