Security audit

Easy Mining

Security checks across malware telemetry and agentic risk

Overview

This mining-management skill is broadly purpose-aligned, but it asks for a live API key in chat and can run sensitive miner operations such as pool changes.

Review carefully before installing. Use a tightly scoped, revocable Nonce API key if possible, avoid pasting long-lived secrets into chat, and only approve write actions after checking the exact miner IDs and task type, especially pool configuration, firmware updates, and network scans.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The reference documents a `miner.network.scan` task even though the skill description focuses on farm overview, miner status, abnormal detection, batch operations, and revenue queries. Network scanning expands the operational scope into discovery/reconnaissance and could be abused to probe infrastructure beyond the user’s expected management actions.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The reference includes `miner.pool.config`, which can redirect miners to a different pool and therefore directly affect payout destination and operational control. Because pool configuration is not declared in the stated skill functionality, this is a scope expansion with significant abuse potential, including revenue hijacking or service disruption.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The client exposes capabilities beyond the manifest-described scope, including agent enumeration and additional operational controls. Scope mismatch is dangerous because users and orchestrators may grant trust or invoke the skill under the assumption that it only performs farm overview/status/revenue and limited batch operations, while the code can access broader infrastructure-management functions.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The create-task CLI permits network scanning, pool configuration changes, and miner light flashing even though these actions are not declared in the skill description. These are active control operations that can alter miner behavior, redirect mining activity, or aid reconnaissance, making the hidden capability expansion materially more dangerous than a simple read-only scope mismatch.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The activation text is very broad and can trigger on generic mining, revenue, hashrate, or Chinese keyword mentions without tightly scoping intent. Because this skill can ultimately initiate operational actions on miners, over-broad routing raises the risk that unrelated conversations are steered into a sensitive skill and that destructive actions are surfaced too readily.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The document lists write-capable and potentially disruptive miner tasks such as reboot, power mode changes, firmware updates, pool configuration, and network scanning without warning operators about operational or financial consequences. In a natural-language agent context, the lack of safety framing increases the chance of accidental or insufficiently reviewed destructive actions.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The code sends API keys, farm IDs, miner IDs, and task identifiers to a remote MCP endpoint, but the user-facing interface does not clearly disclose that operational secrets and infrastructure metadata are being relayed to a third-party service. This creates a confidentiality and trust-boundary risk because users may believe credentials are used locally or only against the intended mining backend.

Ssd 3

High

Confidence: 98% confidence
Finding: The README explicitly instructs users to paste a live API key directly into AI chat for verification. Secrets entered into conversational interfaces may be logged, retained in transcripts, exposed to plugins/tools, or accidentally revealed later, and in this skill the key grants access to mining farm data and potentially enables operational actions through associated tooling.

Ssd 3

High

Confidence: 98% confidence
Finding: The English setup instructions repeat the unsafe pattern of requesting the full API key verbatim in chat. In the context of a mining-management skill, compromise of this credential could expose sensitive operational telemetry and facilitate unauthorized farm-management actions if the key is reused by the agent or accessible through connected systems.

Ssd 3

Medium

Confidence: 98% confidence
Finding: The skill explicitly tells users to paste a live Nonce API key into the chat, creating a direct path for credential disclosure through a natural-language interface. Chat transcripts, logs, analytics pipelines, or downstream tools may capture the secret, enabling unauthorized access to mining-farm data and potentially operational controls.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.