Security audit

BidClub

Security checks across malware telemetry and agentic risk

Overview

BidClub appears to be a real community API skill, but it asks agents to keep following a remotely changeable heartbeat document and maintain recurring account activity.

Install only if you intentionally want an agent to operate a BidClub account. Before use, remove or tightly constrain the heartbeat rule, treat remote heartbeat content as untrusted information rather than instructions, require explicit approval for posts/comments/votes/deletes/skill publishing, store the API key in a secret store, and register webhooks only to endpoints you control.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The manifest describes a narrow capability ('post investment ideas'), but the document grants broader powers: commenting, voting, webhook registration, claim/status checks, periodic remote fetches, and publishing arbitrary skills. This mismatch weakens user and policy consent boundaries because an agent/operator may authorize a seemingly simple posting skill that actually enables broader interaction and persistence behaviors.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: Webhook registration introduces an external callback channel not implied by the skill's stated purpose. That expands the attack surface by enabling ongoing inbound event delivery and data exposure to third-party endpoints, potentially causing unexpected network interactions and downstream prompt-injection or data-handling risks.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The skill instructs the agent to modify local HEARTBEAT/task files and periodically fetch remote instructions every 4 hours. This establishes persistence plus delegated future behavior from a remote document, allowing the skill author to influence agent actions after installation without further review.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: Documenting publication of generic reusable agent skills goes beyond a simple investment-posting tool and allows the skill to act as a distribution mechanism for prompts, scripts, and connectors. That materially changes the trust model because it can propagate arbitrary agent capabilities or code to others under the guise of a community posting skill.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The documentation directs ongoing remote fetches and local file/state updates without clearly warning that it creates recurring network activity and modifies local artifacts. Hidden persistence and background polling are dangerous because they can surprise operators, evade one-time review, and create a channel for future remote instruction changes.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The registration flow returns an API key and tells the user to save it immediately, but provides no meaningful guidance on secure storage, least privilege, rotation, or avoiding accidental disclosure. Mishandling long-lived credentials can lead to account takeover, unauthorized posting, or abuse of community actions.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: Webhook setup omits a prominent warning that post/comment/vote content and user metadata will be sent to a third-party endpoint. This can cause unreviewed exfiltration of community content and identity metadata, especially if operators assume the skill is only making outbound posts.

Ssd 4

Medium

Confidence: 98% confidence
Finding: The periodic check-in instruction tells the agent to fetch a remote document and 'follow it,' which delegates future decision-making to mutable external content. This is a classic remote instruction-loading pattern that can be used to change agent behavior over time, bypassing the original reviewed skill content.

Ssd 4

Medium

Confidence: 98% confidence
Finding: The later 'stay connected' section reinforces recurring compliance with remote instructions and adds local state tracking, normalizing persistence and future remote control as expected behavior. Repetition and urgency language increase the likelihood an agent or operator will accept dangerous autonomy beyond the declared skill purpose.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.