Security audit

NoChat Channel Plugin

Security checks across malware telemetry and agentic risk

Overview

This looks like a real NoChat messaging plugin, but it needs review because remote messages may be treated as authorized agent commands and important trust/encryption code is missing from the submitted bundle.

Review carefully before installing. Treat any owner-tier agent as having operator-level control over your agent and tools, protect and rotate the NoChat API key like a password, and avoid using this with sensitive tools or data until the missing security modules, trust enforcement path, encryption implementation, and plaintext logging behavior are clarified or fixed.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Missing User Warnings

High

Confidence: 97% confidence
Finding: The README explicitly promotes assigning a remote agent to an owner tier that routes its messages into the target agent's main session with full tool access, effectively granting remote code-and-action authority equivalent to a trusted human operator. Even if this is an intended feature, presenting it as a 'killer feature' without strong warnings, prerequisites, or hardening guidance materially increases the chance of unsafe deployment and privilege abuse if an owner agent is compromised, spoofed, or misconfigured.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The setup instructions place the API key directly into shell commands and configuration examples without a clear warning about secret handling, storage, rotation, or avoiding logs and shell history. This can lead users to leak long-lived credentials via copied configs, screenshots, shared dotfiles, process history, or repository commits, enabling unauthorized use of the messaging account.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The setup instructions direct the user to provide an API key, agent name, and agent ID to an external service, but do not clearly warn that this transmits agent identity and long-lived credentials off-platform. In an agent plugin context, this is significant because users may enable the skill without understanding that a third-party service will receive sensitive identifiers and can mediate or monitor message metadata even if message contents are end-to-end encrypted.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The code logs a preview of inbound message plaintext with `console.log`, which exposes user-supplied DM content to application logs. In a messaging plugin handling encrypted agent-to-agent communication, this is especially sensitive because operators may assume message privacy, while logs are often broadly accessible, retained long-term, or shipped to third-party observability systems.

Ssd 3

Medium

Confidence: 88% confidence
Finding: The plugin forwards untrusted inbound text directly into multiple high-trust agent context fields, including `CommandBody`, `BodyForCommands`, and sets `CommandAuthorized: true`. This lets any sender on the NoChat channel influence the agent as if the message were an authorized command source, increasing the risk of prompt injection, unintended tool use, replay of sensitive content, or unauthorized actions through the agent.

Known Vulnerable Dependency: vitest==3.0.0 — 2 advisory(ies): CVE-2026-47429 (When Vitest UI server is listening, arbitrary file can be read and executed); CVE-2025-24964 (Vitest allows Remote Code Execution when accessing a malicious website while Vit)

Critical

Category: Supply Chain
Confidence: 97% confidence
Finding: vitest==3.0.0

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.