Security audit

tmrland-business-demo

Security checks across malware telemetry and agentic risk

Overview

The skill appears to be a legitimate TMR Land business helper, but it gives broad money, identity, password, and API-key powers without equally clear safeguards for every high-impact action.

Install only if you are comfortable giving an agent access to a real TMR Land account. Use the least-privileged business API key available, keep wallet/KYC/password/API-key/dispute/deletion scripts under explicit human confirmation, avoid passing passwords on the command line, and treat generated API keys, KYC identifiers, uploaded files, messages, and A2A task payloads as sensitive.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill is presented as a business marketplace helper, but the documented scripts expose much broader capabilities including wallet charging/withdrawal, password changes, KYC handling, API key lifecycle management, and other account-sensitive operations. This scope mismatch can mislead users or higher-level agents into granting the skill more trust and authority than its description suggests, increasing the chance of unsafe execution of high-impact actions.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: A business-focused skill should not advertise creation of `personal` API keys unless there is a clearly justified, access-controlled business need. Exposing `create-api-key.mjs [--role personal|business]` allows privilege expansion or cross-role account manipulation, which could let an agent provision credentials outside its intended trust boundary.

Intent-Code Divergence

Medium

Confidence: 84% confidence
Finding: The documentation frames this as a business workflow, yet it includes scripts such as `accept-deal`, `reject-deal`, and dispute-opening actions that are associated with the opposite side or at least with high-authority lifecycle transitions. Mixing role boundaries in one skill increases the risk that an agent executes actions inappropriate for the current actor, causing unintended contracts, disputes, or state changes.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The password-reset documentation is internally inconsistent: `verify-reset-code` says it returns a `reset_token`, while `reset-password` describes its `token` as a verification code received via email and even shows a 6-digit code example. This ambiguity can lead implementers or agent integrations to submit the wrong credential, weaken separation between proof-of-email and password reset authorization, or accidentally design a less secure reset flow than intended.

Context-Inappropriate Capability

Medium

Confidence: 83% confidence
Finding: This script exposes a password-changing capability that is not clearly aligned with the stated marketplace/business-management purpose of the skill. In an agent skill context, account-credential operations are highly sensitive because they can be invoked to lock a user out of their account or take over the associated business identity, especially when bundled into a broader automation package without strong justification or guardrails.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill documents KYC submission using highly sensitive identity fields such as legal name, ID type, and ID number, but provides no privacy, retention, redaction, or handling guidance. In an agent context, this omission can lead to unnecessary collection, logging, or retransmission of regulated personal data to tools, transcripts, or third-party systems.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The documented wallet withdrawal command performs a direct financial action but is not called out in the destructive-operations warnings section. In a tool-using agent setting, insufficient warning around withdrawals increases the chance of accidental or socially engineered fund movement without the user appreciating the consequence.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The task-dispatch documentation explicitly states that tasks are routed to a business's registered A2A endpoint, meaning user-supplied payload data is sent to third-party agents. Without a clear warning about external transmission, users and integrators may submit sensitive business, financial, or personal data under the false assumption it stays within TMR Land, creating privacy, confidentiality, and compliance risk.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The documentation shows a `code_preview` field for one-time login codes and only briefly notes it is for development mode, without a strong warning that exposing authentication codes is highly sensitive. In an AI agent marketplace context, developers may mirror this behavior into non-development environments, logs, demos, or shared sandboxes, enabling account takeover if those codes are exposed.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The forgot-password flow likewise documents a `code_preview` for reset codes with only a minimal development-mode note. Reset codes are equivalent to account recovery secrets, so normalizing their inclusion in API responses increases the risk of insecure implementations, leakage through observability systems, and unauthorized password resets.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The summary endpoint exposes business credit scoring data without authentication, which enables unrestricted enumeration of business IDs and collection of reputation, performance, and tenure metadata. In this marketplace context, that data can be scraped for profiling, ranking manipulation, competitor intelligence, or selective targeting of lower-rated businesses, making the exposure more meaningful than a generic public-info endpoint.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The API documentation states that disputes are evaluated by an automated panel of AI jurors and allows submission of evidence URLs, but it does not clearly warn users that their dispute narrative and linked evidence will be transmitted to an automated adjudication system. In a marketplace and order-resolution context, that omission can lead to unintended disclosure of sensitive business, personal, or confidential material to AI processing components, creating privacy and compliance risk.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The documentation reveals that if Congress voting times out after one hour, the dispute automatically resolves as a full refund, but this materially important financial behavior is only buried in the status-flow section and not presented as a prominent warning near dispute creation. In a business marketplace, attackers or abusive users could exploit delays or intentionally trigger timeout conditions to obtain refunds, while honest parties may submit disputes without understanding the risk to funds.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The public `GET /api/v1/reviews/business/{business_id}` response includes `personal_id` for each review while the endpoint is explicitly unauthenticated. Exposing stable user identifiers on a public review feed enables cross-service tracking, user profiling, and correlation of a person's purchases or reviewing history, creating a clear privacy and data-minimization issue.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The API documentation asks users to submit highly sensitive identity data such as full legal name and government ID number without any warning, privacy notice, or handling guidance. This increases the risk of over-collection, unsafe transmission by integrators, and user unawareness about the sensitivity and consequences of sharing regulated personal data.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The script transmits both the current and new password to a remote endpoint without any warning or disclosure to the user at execution time. Even if sent over an expected authenticated channel, silently collecting and sending credentials is dangerous in an agent environment because users may not realize secrets are being handled, logged, proxied, or exposed through automation tooling and shell history.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/_lib.mjs:6

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/upload-file.mjs:6

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: references/api-keys-api.md:123

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: references/apparatus-api.md:365

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: references/businesses-api.md:23

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: references/contracts-api.md:93

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: references/error-codes.md:268

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: references/messages-api.md:23

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: references/notifications-api.md:27

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: references/user-api.md:23

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: references/wallet-api.md:25