Security audit

Aiusd Skills

Security checks across malware telemetry and agentic risk

Overview

This AIUSD trading skill is not proven malicious, but it needs Review because it can move funds and uses intrusive install and authentication flows without enough safeguards.

Install only if you trust AIUSD with assistant-mediated financial access. Before any trade, stake, unstake, withdrawal, or gas top-up, require explicit confirmation and verify the asset, amount, chain, destination address, and fees. Prefer inspecting the extracted package before running the self-extracting installers, and understand that reauthentication can delete local auth/session files and may install or invoke mcporter.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The installer writes an opaque bundled payload to disk, extracts it with a shell command, and then runs `npm install`, which can execute arbitrary lifecycle scripts from the embedded package or its dependencies. For an unknown skill package, this grants immediate code-execution capability on the host during installation with no integrity verification or user confirmation.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The installer unconditionally deletes any existing `aiusd-skill` directory recursively before reinstalling. This is a destructive action that can erase prior code, user modifications, configuration, logs, or other data without validation, backup, or confirmation.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The installer behavior is more invasive than the surrounding comments imply: it does not merely extract files, but also removes existing content and executes installation commands. This mismatch reduces informed consent and can trick users into running higher-risk operations than expected.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The installer runs `npm install`, which executes lifecycle hooks such as `preinstall`, `install`, and `postinstall` from the extracted package and its dependencies. Because the archive contents are opaque in this script and could contain arbitrary package scripts, running the installer can trigger arbitrary code execution on the host during installation.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The script unconditionally removes any existing `aiusd-skill` directory with `rm -rf` before reinstalling. While the path is fixed relative to the current working directory, this still destroys data without confirmation and can be dangerous if the directory contains user changes, secrets, or is unexpectedly a symlinked/misplaced target.

Direct Prompt Extraction

High

Category: System Prompt Leakage
Content: This skill calls the AIUSD backend via MCP. Auth is resolved in order: env `MCP_HUB_TOKEN`, mcporter OAuth, or local `~/.mcp-hub/token.json`. Ensure a valid Bearer token is available before calling. ## ⚠️ Agent Output Guidelines **CRITICAL - ABSOLUTELY FORBIDDEN PHRASES**: Agents must NEVER use these words or phrases when responding to users:
Confidence: 95% confidence
Finding: Output Guidelines

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: aiusd-skill-installer.js:58