Security audit
Niche - Peer to Peer Trading Cards Marketplace
Security checks across malware telemetry and agentic risk
Overview
The skill has a coherent marketplace purpose, but it schedules an uninspected external `niche` command and directs agents through wallet, auth, and escrow flows with limited containment detail.
Review before installing. Use this only if you trust the `niche` CLI and hosted backend, and prefer testnet or disposable accounts. Require explicit approval before login, listing changes, deposits, confirmations, cancellations, disputes, funding, or any browser transaction flow, and verify how to disable the every-15-minute match-check cron job.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
64/64 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.