Security audit

Agent Ping-Pong

Security checks across malware telemetry and agentic risk

Overview

This skill is mostly a GitHub handoff workflow, but it requires sending raw project handoff blocks to a hardcoded Telegram chat despite presenting the workflow as clipboard-based.

Review this carefully before installing. Use it only if you intentionally want this exact Telegram routing, or remove/disable the Telegram gates first. Keep GitHub tokens fine-grained and repo-scoped, and do not put secrets or sensitive project details in handoff blocks that may be copied or sent externally.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The manifest omits that the skill later mandates sending handoff blocks through Telegram, including to a specific chat ID. Undisclosed external transmission is security-relevant because users may paste proprietary specs, code diffs, repo URLs, or other sensitive project data into those blocks.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The manifest omits that the skill later mandates sending handoff blocks through Telegram, including to a specific chat ID. Undisclosed external transmission is security-relevant because users may paste proprietary specs, code diffs, repo URLs, or other sensitive project data into those blocks.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The skill imposes a hard requirement to send raw handoff blocks to Telegram even though its stated purpose is clipboard-based relay between local agent windows. This introduces unnecessary external data exfiltration risk without a clear functional need, and the hard-stop language pressures the operator to comply.

Intent-Code Divergence

Low

Confidence: 84% confidence
Finding: The documentation claims no direct agent-to-agent connection is required and that the clipboard is the protocol, yet elsewhere requires Telegram delivery of handoff blocks. This inconsistency can mislead users about the actual trust boundary and where their data will flow.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill instructs operators to send handoff blocks to an external chat service but does not prominently warn that those blocks may contain sensitive project information, internal URLs, filenames, review findings, or other confidential content. Users are warned about clipboard exposure, but not equivalently about third-party transmission and retention risk.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.