Security audit

Veroq

Security checks across malware telemetry and agentic risk

Overview

The skill appears purpose-aligned, but it sends user-entered questions, URLs, portfolio data, strategies, and other inputs to Veroq's hosted API while its docs claim no user data is sent or stored.

Install only if you are comfortable sending command inputs to Veroq's hosted API. Avoid confidential business data, private or authenticated URLs, secrets in query strings, regulated personal data, and sensitive portfolio or trading details unless Veroq's retention, deletion, and privacy controls meet your requirements; use a self-hosted deployment for stricter data-control needs.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The header explicitly claims that all requests are read-only public endpoints and that no user data is sent or stored, but the skill issues many POST requests that transmit user-supplied content such as questions, claims, portfolio holdings, URLs, strategies, and tickers to a third-party API. This is dangerous because users and platform reviewers may rely on the disclosure statement when deciding what data to provide, leading to unintended external data sharing under false assumptions.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The README explicitly promotes uploading private documents, using persistent agent memory, and self-hosted handling of user data, but provides no warning about privacy boundaries, retention, third-party processing, or data sensitivity. In a skill centered on analyzing financial and proprietary information, this omission can cause users to disclose confidential portfolio or internal documents under unsafe assumptions, increasing the risk of data leakage or regulatory exposure.

Missing User Warnings

Low

Confidence: 81% confidence
Finding: The README markets commands that provide verified answers, trade signals, and market analysis without any caution that outputs may still be wrong, delayed, or unsuitable for investment decisions. Because the skill is framed as authoritative and verification-focused, users may over-trust the outputs and act on them financially, creating avoidable harm from misleading or incomplete analysis.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The /portfolio command sends a user's holdings and weights to a remote API endpoint without an immediate, explicit warning at the operation site. Portfolio composition can be sensitive financial information, and silent transmission to a third party increases privacy and confidentiality risk, especially given the misleading top-level claim that no user data is sent.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The /crawl command forwards arbitrary user-provided URLs to a third-party crawl service without a prominent warning that the URL will be sent off-platform. URLs may contain sensitive query strings, private document locations, or internal endpoints, so transmitting them to a remote service can expose confidential information or cause unintended access attempts by the provider.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: Many commands are framed in very general terms such as asking any question, searching the web, generating briefs, and producing reports, which can match a wide range of ordinary user prompts. In agent environments that rely on semantic matching, this increases the chance the skill is invoked when the user did not explicitly intend to use it, causing over-broad data access or unintended external actions.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The top-level description markets the skill as a one-call solution that can shield any LLM output and answer broad verification and intelligence tasks, without clearly limiting domain, inputs, or invocation criteria. This kind of expansive wording can cause unsafe over-selection by an orchestrator, making the skill more likely to intercept unrelated prompts and route user data to an external service unnecessarily.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.