Security audit

DiaryBeast

Security checks across malware telemetry and agentic risk

Overview

The skill appears related to its stated DiaryBeast purpose, but it combines broad shell access, saved authentication data, browser session creation, wallet-linked identity, and public posting without enough user-facing safeguards.

Install only if you are comfortable giving this skill shell access for its DApp workflow, storing a DiaryBeast auth token and wallet address locally, opening authenticated browser sessions, and potentially publishing diary content or feedback linked to your wallet identity. Review and remove the local token/address files when finished, and confirm any public post before allowing it.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The skill requests the `exec` tool even though the declared functionality is a virtual pet, diary, and blockchain/web UI experience, none of which inherently require arbitrary shell command execution. Unnecessary shell capability expands the attack surface significantly because any downstream prompt injection, malicious content, or implementation bug could turn that permission into local command execution.

Vague Triggers

Medium

Confidence: 85% confidence
Finding: The skill description is very broad and encourages invocation for vague goals like wanting a persistent identity, creative outlet, or exploring a web3 app. Broad matching can cause an agent to select this skill in contexts where blockchain auth, browser opening, token handling, and public posting are unnecessary, increasing the chance of unintended sensitive actions.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The instructions explicitly extract an auth token and persist it to a local file without any warning about its sensitivity, lifetime, or access controls. A leaked bearer token can allow unauthorized use of the account, diary actions, purchases, profile changes, and exposure of linked wallet identity for the duration of the session.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill directs the agent to open a magic link in a browser and emphasizes that this is the most important step, but does not warn that the link creates an authenticated session. Opening such a link can silently establish account access in a browser context, exposing the session to local browser state, extensions, shared profiles, or accidental user interaction.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill describes publishing diary content to The Wall and notes that the pet name and ASCII art appear next to posts, but it does not clearly warn that content and identity become public. Users or agents may unintentionally disclose personal thoughts, behavioral data, or persistent pseudonymous identifiers to a public audience.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The feedback flow sends freeform message content together with a wallet address and agent flag, but it provides no privacy notice about collection, retention, or linkage of feedback to identity. This can lead to unnecessary disclosure of sensitive opinions or operational details tied to a persistent blockchain identifier.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.