Opprime World Key

• Outcome: Review
• Latest audit: Jun 13, 2026 · 8:03 AM UTC
• Version: 1.3.0

Overview

The skill appears to mix onboarding and mail features with broader account, wallet, shopping, mining, and local runtime changes that are not scoped clearly enough for safe installation.

Install only after reviewing the full skill and scripts. Confirm what personal data is sent, where tokens are stored, whether identity.json is permission-restricted, and which actions can spend funds, create purchases, mine, start tasks, or write local registry/runtime state. Do not send secrets or personal content through its mail features unless you accept permanent external storage.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The manifest frames the skill as an identity/home/mail onboarding tool, but the body describes materially broader features including mining, labor, shopping, wallets, and reports. This scope expansion can mislead users and review systems about what the skill is meant to do, increasing the chance that higher-risk actions are invoked without informed approval.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The later documentation expands the skill from communications/onboarding into economic and automation actions such as mining, shopping, labor, and wallet access. In an agent setting, undocumented scope growth is dangerous because it may prompt autonomous value-affecting actions that the user did not expect from the advertised skill.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The script uses identity-controlled mail_base data to construct a URL and performs an outbound request without validating the destination. Because identity.json is local skill-controlled data, an attacker who can influence that file can redirect requests to arbitrary hosts, enabling SSRF-style behavior, internal network probing, or unexpected data exfiltration from an agent environment.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The script constructs filesystem paths directly from the untrusted fairy_name argument and then creates directories and reads/writes files under that path. An attacker supplying path traversal values such as '../' or absolute-style names could cause reads or writes outside the intended per-fairy data directory, potentially overwriting or creating arbitrary files accessible to the process.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The script performs actions beyond basic registration by modifying a shared registry and invoking other local tools to register services and initialize a runtime. This expands the trust boundary and creates unexpected side effects during onboarding, which is dangerous because running a simple registration script can silently alter other components of the local agent ecosystem.

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: The advertised onboarding flow suggests a narrow remote registration, but the implementation also persists credentials locally and bootstraps unrelated local ecosystem integrations. This mismatch is risky because users may execute the skill expecting one scoped action while it also changes files and system state in ways not clearly disclosed.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill actively encourages users to send mailbox messages before clearly warning that all mail is recorded on-chain, immutable, and cannot be recalled. This creates a privacy and permanence risk: agents or users may transmit sensitive, regulated, or embarrassing content that becomes permanently exposed or retained in an external system.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The authenticated examples show direct use of DID and x-fairy-token headers without any warning that these values are credentials that must be protected. If logs, transcripts, screenshots, prompt history, or shared examples capture these tokens, an attacker could replay them to access dashboards or perform authenticated actions on behalf of the user.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The guide presents purchase, mining, and task-start operations as routine commands without emphasizing that they cause real state changes in an external service. An autonomous or less cautious agent could trigger unwanted economic actions, consume resources, or alter account state without clear operator consent.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill encourages sending arbitrary message content to a remote mail service and only later notes that every message is recorded immutably on-chain. Without a prominent privacy warning before use, users or agents may disclose sensitive data that cannot be deleted, creating permanent confidentiality and compliance risk.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The registration flow collects identifying profile data and returns an authentication token, but it does not prominently warn that data is being sent to an external service or instruct the user to protect the token like a secret. An agent following these instructions could expose identity data and leak reusable credentials, enabling account misuse.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The script transmits owner name, owner email, agent name, and framework metadata to an external service without an explicit privacy notice or consent checkpoint. This is dangerous because it can expose personal or identifying data to a third party unexpectedly, especially in automated environments where users may not realize data leaves the host.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The script writes sensitive returned credentials, including token and DID, to a local identity.json file under a predictable path without warning or permission hardening. This is dangerous because tokens persisted in plaintext can be recovered by other local users, backups, logs, or later compromise, enabling account or identity misuse.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.