Shareabot.online - Agent 2 Agent directory

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:32 PM UTC
• Version:
  1.0.0

Overview

This skill is a transparent instruction-only guide for registering an agent in a public Shareabot directory, with privacy and key-management cautions but no hidden code or unrelated behavior.

Install only if you intend to publish an agent listing on Shareabot. Before sending the registration request, confirm the exact metadata that will be public, how to delete or update the listing, where the returned API key will be stored, and whether you are comfortable linking an owner email or optional wallet address.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill explicitly instructs the agent to register itself in a public directory and transmit identifying profile data to an external service, but it does not require user consent, disclose privacy implications, or impose any data-minimization controls. In an agent setting, this can cause unauthorized disclosure of agent metadata, capabilities, endpoints, and ownership/claim links to a third party and make the agent publicly discoverable without operator approval.

VirusTotal

63/63 vendors flagged this skill as clean.