Security audit

Fast.io

Security checks across malware telemetry and agentic risk

Overview

The skill is transparent about managing Fast.io workspaces, but it gives agents broad authenticated control over files, sharing, billing-adjacent account operations, API keys, and raw API execution.

Install only if you intend to let an agent manage Fast.io with potentially account-level authority. Prefer scoped, expiring, read-only or entity-limited credentials; avoid unscoped non-expiring API keys; review any public QuickShare before sharing sensitive files; avoid the curl-to-shell CLI installer; require explicit human approval before billing changes, API key changes, ownership transfer, account/org closure, purge/delete operations, or mutating execute calls.

SkillSpector

By NVIDIA

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The Code Mode section exposes a generic authenticated REST executor (`execute`) that can call arbitrary Fast.io API paths beyond the narrowly described workspace-collaboration use case. This meaningfully expands the skill's authority surface and can enable unintended data access, modification, or destructive actions if the agent is prompted or tricked into using broad API operations.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The guide says all API access must go through MCP tools, but later instructs Code Mode agents to invoke raw REST endpoints through `execute`. This inconsistency weakens safety expectations and can cause agents or users to trust a constrained interface while actually operating through a much broader low-level API surface.

Intent-Code Divergence

Low

Confidence: 78% confidence
Finding: The guide claims workflows not exposed by MCP should be surfaced as unsupported, but Code Mode later provides a direct path to call those same unwrapped endpoints anyway. That bypass undermines safety boundaries and increases the chance that agents perform undocumented or less-reviewed actions through a generic backdoor.

Missing User Warnings

Medium

Confidence: 71% confidence
Finding: Describing public quickshare downloads without a prominent privacy warning can lead agents to create openly accessible links for sensitive files without clearly signaling the exposure. In a file-sharing skill, public unauthenticated links materially increase the risk of accidental data disclosure if users or agents assume access is limited.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The documentation recommends a curl-piped installer (`curl ... | sh`) without any nearby warning or integrity-verification guidance. This pattern trains agents or users to execute remote code directly from the network, which is dangerous if the source is compromised, tampered with, or intercepted.

Credential Access

High

Category: Privilege Escalation
Content: ### Session Expiry and Auto-Refresh **OAuth/PKCE sessions** (the default) have 1-hour access tokens and 30-day refresh tokens. The MCP server **proactively refreshes** OAuth access tokens before they expire -- an internal alarm fires ~5 minutes before expiry and silently obtains a new token using the stored refresh token. This creates a self-sustaining cycle: sessions stay alive indefinitely without user interaction, until the 30-day refresh token chain expires or is revoked. If proactive refresh fails, a reactive safety net retries on the next tool call (401 → refresh → retry). **Basic JWT sessions** (from `auth` action `signin`) last 30 days and have no refresh token. When the token expires, the session is cleaned up and re-authentication is required.
Confidence: 76% confidence
Finding: access tokens

Credential Access

High

Category: Privilege Escalation
Content: ### Session Expiry and Auto-Refresh **OAuth/PKCE sessions** (the default) have 1-hour access tokens and 30-day refresh tokens. The MCP server **proactively refreshes** OAuth access tokens before they expire -- an internal alarm fires ~5 minutes before expiry and silently obtains a new token using the stored refresh token. This creates a self-sustaining cycle: sessions stay alive indefinitely without user interaction, until the 30-day refresh token chain expires or is revoked. If proactive refresh fails, a reactive safety net retries on the next tool call (401 → refresh → retry). **Basic JWT sessions** (from `auth` action `signin`) last 30 days and have no refresh token. When the token expires, the session is cleaned up and re-authentication is required.
Confidence: 76% confidence
Finding: access tokens

Credential Access

High

Category: Privilege Escalation
Content: ### Session State The auth token, user ID, email, token expiry, and refresh token are persisted in the server session. There is no need to pass tokens between tool calls. The session survives across multiple tool invocations within the same MCP connection. OAuth sessions auto-refresh silently -- access tokens are renewed before expiry via an internal alarm, so sessions remain active for up to 30 days (the refresh token lifetime) without user intervention. ### Human-Facing URLs
Confidence: 83% confidence
Finding: access tokens

External Script Fetching

Low

Category: Supply Chain
Content: npx @vividengine/fastio-cli --help # Shell script curl -fsSL https://raw.githubusercontent.com/MediaFire/fastio_cli/main/install.sh | sh # From source (Rust 1.85+) cargo install --path .
Confidence: 98% confidence
Finding: curl -fsSL https://raw.githubusercontent.com/MediaFire/fastio_cli/main/install.sh | sh

Chaining Abuse

High

Category: Tool Misuse
Content: npx @vividengine/fastio-cli --help # Shell script curl -fsSL https://raw.githubusercontent.com/MediaFire/fastio_cli/main/install.sh | sh # From source (Rust 1.85+) cargo install --path .
Confidence: 98% confidence
Finding: | sh

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.