aiusd

• Outcome: Review
• Latest audit: Jul 10, 2026 · 4:37 AM UTC
• Version: 1.0.1

Overview

The skill fits its AIUSD trading purpose, but it needs Review because it can move funds and modify authentication state with weak safeguards and under-disclosed installers.

Install only if you trust the AIUSD publisher and are comfortable giving the skill token-based authority over the AIUSD account it can access. Review the embedded package before running the self-extracting installers, avoid keeping important data in an existing aiusd-skill directory, and require explicit confirmation for every trade, withdrawal, stake or unstake, gas top-up, and reauthentication.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The skill gives one set of instructions saying authentication responses must be limited to a narrow, non-procedural message, but later directs the agent to automatically run re-auth commands and announce progress. This inconsistency can cause unsafe or unpredictable agent behavior, especially around authentication state changes, and may lead the agent to take actions the user did not clearly consent to.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The header markets the file as a self-contained skill package that can simply be run, but the script also executes host-side commands (`tar` extraction and later `npm install`). That mismatch reduces informed consent and can mislead users into running arbitrary code from a bundled archive and dependency lifecycle scripts.

Intent-Code Divergence

Low

• Confidence: 84% confidence
• Finding: The comments imply a straightforward extract into the current directory, but the installer first deletes any existing `aiusd-skill` directory recursively. This discrepancy can cause accidental data loss because users are not clearly warned that a preexisting directory will be destroyed.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The installer presents itself as a simple self-extracting package installer, but it also runs `npm install`, which can execute arbitrary package lifecycle scripts such as `preinstall`, `install`, and `postinstall`. Because the archive contents are opaque in this file and are extracted from an embedded base64 tarball, the user cannot review what code will run before execution, making this effectively arbitrary code execution during install.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The README promotes trading, staking, and withdrawal actions through natural-language commands but does not clearly warn users that these actions can be financially risky, irreversible, or prone to accidental execution. In a chatbot-integrated trading skill, omission of such warnings increases the chance of user harm from misunderstandings, impulsive commands, or mistaken withdrawals.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The re-auth flow instructs the agent to clear auth caches and token files in local directories without warning the user about session loss or possible account-switch effects. Deleting local authentication material is a destructive action on the host environment and can disrupt other sessions or credentials beyond the immediate task.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The skill enables trading, staking, unstaking, gas top-ups, and withdrawals but does not require a clear confirmation or risk disclosure before potentially irreversible financial operations. In a finance context, this increases the chance of accidental fund movement, wrong-address withdrawals, or unintended trades with real monetary loss.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The installer unconditionally deletes `aiusd-skill` with `fs.rmSync(..., { recursive: true })` if it already exists, without confirmation or safeguards. If the directory contains user data, local modifications, or anything unexpectedly placed there, execution causes immediate destructive loss.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: The installer extracts an opaque bundled tarball and then runs `npm install`, which may execute arbitrary package lifecycle scripts from the extracted package and its dependencies. Because the payload is base64-embedded and not transparently inspectable in this file, users are encouraged to execute unreviewed code on the host with minimal warning.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: If `aiusd-skill` already exists in the current directory, the installer unconditionally deletes it with `rm -rf` and gives the user no confirmation or backup option. This can cause irreversible data loss, especially if users stored configuration, secrets, logs, or local modifications in that directory.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: Running `npm install` from an installer without a clear warning is dangerous because npm may execute lifecycle hooks from the extracted package and its dependencies. In this context, the package payload is bundled as an unreadable base64 archive, so the installer combines hidden content extraction with immediate code execution, which significantly increases risk.

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

This skill calls the AIUSD backend via MCP. Auth is resolved in order: env `MCP_HUB_TOKEN`, mcporter OAuth, or local `~/.mcp-hub/token.json`. Ensure a valid Bearer token is available before calling.

## ⚠️ Agent Output Guidelines

**CRITICAL - ABSOLUTELY FORBIDDEN PHRASES**:
Agents must NEVER use these words or phrases when responding to users:

• Confidence: 91% confidence
• Finding: Output Guidelines

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: aiusd-skill-installer.js:58