Security audit

mcp-llm-inference

Security checks across malware telemetry and agentic risk

Overview

This is a plausible remote LLM inference skill, but it needs review because it sends prompts to an external service and its install/configuration artifacts disagree.

Install only if you are comfortable sending prompts and chat history to the configured LLM provider. Verify the exact npm package before use, prefer pinning a package version, and use NAUTDEV_BASE_URL if you need to control the endpoint because L402_API_BASE_URL is declared in SKILL.md but not used by the code.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The README explicitly advertises remote LLM inference and L402 micropayments, but it does not clearly warn users that prompts, chat history, and generated content are sent to an external third-party service and that usage may automatically incur paid requests. In an agent setting, this can lead to unintended disclosure of sensitive data and unexpected financial spend because operators may treat the tool like a local capability rather than a networked paid service.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill forwards user prompts and chat messages to a third-party remote API endpoint, which can expose sensitive data entered by users or passed by upstream agents. In an MCP/agent context, this is materially risky because tool users may assume local processing unless explicit disclosure, consent, and data-handling boundaries are provided.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill forwards user-supplied prompts and chat messages to a third-party remote API, but the code provides no disclosure, consent mechanism, redaction, or policy guardrail before transmission. In an MCP/agent context, prompts can contain sensitive user data, secrets, system instructions, or proprietary context, so silent exfiltration to an external provider creates a real confidentiality risk even if this is the intended product behavior.

VirusTotal

57/57 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: dist/index.js:7

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: src/index.ts:7