Security audit

Stegstr

Security checks across malware telemetry and agentic risk

Overview

This is a coherent Stegstr image-steganography skill, but installing it means trusting an unpinned GitHub source build and handling Nostr private keys carefully.

Install only if you trust the Stegstr GitHub project and its Rust dependencies. Prefer reviewing or pinning a known commit/release in sensitive environments, and do not paste real Nostr private keys into agent chats or shell commands that may be logged.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The skill is presented primarily as a steganography utility, but its documented installation and usage path requires cloning a remote repository and building/executing a locally produced binary. That expands the trust boundary from simple file processing to supply-chain risk and code execution, which should be explicitly disclosed because an agent or user may otherwise treat it as a low-risk data transformation skill.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The installer fetches source from a remote Git repository and then compiles and installs a native binary locally. This creates a supply-chain and arbitrary code execution risk because whoever controls the repository, a compromised dependency, or a tampered URL can cause unreviewed code to run during build, which goes beyond simple steganography use and materially changes the trust boundary.

Scope Creep

High

Confidence: 99% confidence
Finding: The script performs network access via git clone/git pull and executes external build tooling with cargo, despite the skill manifest declaring only filesystem permission. This permission mismatch is dangerous because users and security controls may trust the declared permission scope, while the installer actually reaches outside that boundary and can trigger code execution from fetched content.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The examples instruct users to pass a Nostr private key directly on the command line, which can expose sensitive credentials through shell history, process listings, logs, agent transcripts, or monitoring tools. In an agent context this is more dangerous because the agent may echo, store, or transmit the key while following the documented example.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The script modifies the local system by cloning or updating a repository, building binaries, creating directories, and force-overwriting a symlink in the user's bin directory without an explicit warning or confirmation. While common in ad hoc installers, this can surprise users, replace an existing command, and make recovery harder if the installed binary is malicious or simply incompatible.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.