Security audit

Tmp.PDd7BrUK9d

Security checks across malware telemetry and agentic risk

Overview

The skill is a mostly transparent curl guide, but it includes live account-changing portal actions that are not prominent enough in the top-level description.

Install only if you are comfortable giving an agent instructions that can use your Crown Town Compost login and session cookie. Treat the write sections as live account actions: confirm explicitly before skip, update, support, missed-pickup, or cancellation flows, and avoid keeping credentials or cookie jars on shared machines.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

High

Confidence: 94% confidence
Finding: The skill metadata and primary description frame the capability as read-oriented portal access, but the body documents authenticated POST operations that can change service schedules, account details, support submissions, and cancellation requests. This mismatch increases the risk that a user or higher-level agent invokes the skill assuming it is non-destructive, leading to unintended state-changing actions on a real customer account.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The endpoint reference includes several state-changing operations such as skip/unskip service, report missed pickup, update account details, contact support, and cancellation request, while the skill description frames the capability primarily as portal data access. This mismatch broadens the effective authority of the skill and increases the chance an agent or user invokes consequential writes without realizing the skill is not read-only.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: Support messaging and cancellation-request flows go beyond retrieving portal data and enable externally visible or service-disrupting actions. In an agent setting, exposing these endpoints without strong justification and gating can lead to unauthorized customer communications or service cancellation requests triggered by prompt confusion, misuse, or overbroad automation.

Missing User Warnings

Medium

Confidence: 82% confidence
Finding: The skill instructs users to place portal credentials in environment variables, which can be exposed through shell history, inherited subprocess environments, debugging output, or local process inspection depending on the platform and workflow. Although it avoids putting the password directly in argv during curl execution, it still normalizes a credential-handling pattern that may leak secrets on shared or poorly controlled systems.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill includes write-capable POST examples that can skip service, modify account settings, submit support messages, and request cancellation, but the warning about operational impact is weak and buried. Without a prominent upfront caution, users or agents may treat these examples as routine reads and accidentally alter live account state.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.