Security audit

Tmp.AotZkVCtxu

Security checks across malware telemetry and agentic risk

Overview

The skill is not deceptive, but it gives shell-based FreshBooks access that can create or change accounting records despite being described mainly as a query helper.

Install only if you want an agent to have shell-mediated FreshBooks access that can read and modify business records. Use a least-privilege FreshBooks app/account if possible, keep tokens out of shared shells and logs, and treat every POST or soft-delete example as a production accounting change requiring explicit review.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill clearly instructs the user to execute shell commands, source secret files, and invoke helper scripts, yet no permissions are declared. This creates a transparency and governance gap: the skill can access local environment secrets and perform networked API actions without an explicit permission contract, increasing the chance of unintended credential exposure or unauthorized API use.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill is described as a query tool, but the documentation explicitly provides POST-based write operations and discusses delete behavior. This mismatch is dangerous because users or higher-level agents may treat the skill as read-only when it can actually modify invoices and potentially soft-delete records, leading to unauthorized or destructive changes in accounting data.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The skill is described as a query-oriented FreshBooks helper, but these recipes include POST-based invoice creation examples that modify remote account state. That mismatch can mislead a user or higher-level agent into performing unintended writes against production financial data, especially because the examples are presented alongside read-only recipes without a prominent destructive-action warning.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The documented client creation, payment recording, and time-entry logging operations expand the skill from data retrieval into state-changing financial/accounting actions. In the context of an agent skill marketed for querying, this increases the risk of accidental or unauthorized writes such as creating customers, recording payments, or logging billable time in a live business account.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The script performs OAuth token exchange and refresh using client credentials supplied on the command line, then prints access and refresh tokens to stdout. In a shell/script context, command-line arguments and stdout are commonly exposed through shell history, process listings, CI logs, terminal scrollback, or pipe consumers, so this creates a real risk of credential and token disclosure even though the network calls are legitimate.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: These recipes perform remote create/write operations but do not clearly warn that they will change accounting records in FreshBooks. Because the affected objects are invoices and other business records, a user may copy-paste commands assuming they are examples for inspection only, causing unintended financial or operational changes.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.