Security audit

file share to filebin.net

Security checks across malware telemetry and agentic risk

Overview

This skill does what it says: uploads a user-specified local file to filebin.net, but users should remember the resulting link is public.

Install only if you want an agent to upload selected files to filebin.net. Before each upload, confirm the exact file path and avoid private, confidential, credential-containing, or regulated data because anyone with the link may access it while the bin exists.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill’s purpose is to upload local files to a public third-party hosting service, but it does not require a prominent pre-upload disclosure or explicit user acknowledgment that the file will become publicly accessible. In an agent setting, that omission can lead to accidental disclosure of sensitive local workspace contents when a user asks to 'share' or 'upload' a file without understanding the privacy consequences.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The procedure provides a direct curl command that transmits local file contents to filebin.net without an explicit confirmation gate immediately before exfiltration. Because the skill operates on local workspace files, the lack of a required consent checkpoint increases the risk of unintended data exfiltration to a public external service.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.