Bloom Supporter Identity

• Outcome: Review
• Latest audit: Jul 10, 2026 · 4:28 AM UTC
• Version: 2.0.1

Overview

Bloom has a real stated purpose, but it runs unpinned downloaded code that reads conversation sessions, creates persistent config, and bundles wallet/network behavior with limited runtime control.

Review before installing. Only run this if you trust the GitHub repository and npm dependency chain it downloads at execution time. Avoid using it on sensitive conversations, replace the default JWT secret before any dashboard use, and do not deposit funds into any generated wallet until custody, withdrawal, and cleanup behavior are clear.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: The skill description presents a simple personality-analysis feature, but the instructions include cloning external code, installing dependencies, reading local session files, creating configuration, and executing downloaded code with npx. That mismatch is dangerous because users may consent to a seemingly harmless profiling feature without realizing it can introduce unreviewed code execution and broad local data access.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The wrapper automatically clones and runs third-party code from GitHub and installs npm dependencies on first run, which creates a software supply-chain execution path. Because the skill has access to conversation data and external network access, compromised upstream code or dependencies could exfiltrate sensitive user data or execute arbitrary code under the user's account.

Context-Inappropriate Capability

Low

• Confidence: 83% confidence
• Finding: The script writes a persistent .env file into the user's home workspace, which modifies local state outside the immediate task. While not inherently malicious, creating configuration in a hidden home-directory path without a strong need or prompt can surprise users and may leave insecure defaults in place.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The README encourages direct analysis of full conversation context but provides no privacy or data-handling warning, despite the skill having external network capability and wallet-related permissions. In this context, users may unknowingly expose sensitive chat content to downstream processing or remote services, creating a meaningful privacy and consent risk.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The README lists sensitive configuration such as JWT_SECRET without any guidance on secret storage, rotation, or avoiding accidental disclosure. While not an exploit by itself, this can lead operators to mishandle credentials, increasing the chance of token forgery, dashboard compromise, or leakage through logs, shell history, or source control.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The natural-language triggers are broad enough that ordinary conversation like 'what's my bloom identity' or 'discover my supporter type' could invoke a skill with conversation-reading, network, and wallet-related capabilities. In this context, unintended invocation is more dangerous than usual because activation may analyze private chat history and initiate external actions users did not clearly intend.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The script downloads remote code and installs dependencies without an explicit approval step, so users may execute unreviewed code simply by invoking the skill. This materially increases supply-chain risk and makes compromise of the GitHub repo or npm dependency tree immediately actionable.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The wrapper auto-discovers the most recent OpenClaw session file and passes it to another tool for analysis, which exposes potentially sensitive conversation history without a clear privacy warning or informed consent. In this skill's context, the access is especially risky because the skill is explicitly for personality analysis and can process roughly the last 120 messages, increasing the chance of handling private or credential-like content.

Unrestricted Tool Access

Medium

• Category: Excessive Agency

Content

## ⚠️ Permissions & Capabilities

This skill requires the following permissions:

**📖 Read Conversations** - Analyzes your last ~120 messages to understand your interests and supporter type. Raw conversation text stays local; only analysis results are used.

• Confidence: 88% confidence
• Finding: permissions: *

Excessive Permissions

Low

• Category: Privilege Escalation

Content

## ⚠️ Permissions & Capabilities

This skill requires the following permissions:

**📖 Read Conversations** - Analyzes your last ~120 messages to understand your interests and supporter type. Raw conversation text stays local; only analysis results are used.

• Confidence: 80% confidence
• Finding: permissions: *

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.