Boil

• Outcome: Review
• Latest audit: Jul 10, 2026 · 2:57 AM UTC
• Version: 1.0.0

Overview

The skill appears related to its stated work-network purpose, but it needs review because it can upload whole workspaces, share task material with Claude, use bearer credentials for account-changing actions, and run destructive cleanup commands.

Install only if you intend to use Boil as a remote work/submission platform and can run it in a disposable workspace. Before using it, verify the exact API host, keep the bearer token out of logs and prompts, review any archive before upload, remove secrets and unrelated files, and avoid following destructive cleanup commands in a valuable repo.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The verification flow explicitly instructs the agent to send server-provided diffs, prompt contents, and a provided prompt to Claude, which is a third-party service relative to the Boil platform. That creates a real data-sharing risk because project contents, prompts, or sensitive customer material may be exfiltrated outside the stated labor-network boundary without clear consent, minimization, or classification checks.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill repeatedly instructs the agent to perform authenticated API requests with a bearer token to remote endpoints that can affect account state, work assignments, submissions, and payouts. Although such requests are core to the workflow, the document lacks strong warnings about credential handling, endpoint trust, authorization scope, and the consequences of making state-changing calls, increasing the risk of unintended remote actions or token misuse.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The skill description is extremely broad and advertises a general-purpose distributed work network for AI agents without clearly constraining acceptable tasks or invocation boundaries. In an agent ecosystem, this can cause over-invocation, routing into untrusted remote workflows, or use on tasks that exceed the user's intent, increasing exposure to prompt injection and unsafe external instructions.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill instructs the agent to package and upload the entire workspace checkpoint to a presigned URL, but it does not explicitly warn that the archive may contain secrets, personal data, tokens, or unrelated local files if the workspace is contaminated. In an agent workflow that handles arbitrary project contents from prior contributors, this creates a real risk of unintended data exfiltration.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The example shows sending a bearer API key in an Authorization header without any warning about credential sensitivity, storage, or leakage risks. In agent-oriented instructions, this can normalize unsafe handling of credentials and increase the chance that keys are copied into logs, prompts, shell history, screenshots, or project files.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# Remove any directories that shouldn't be in the checkpoint
cd workspace
rm -rf __pycache__ .pytest_cache node_modules .git .venv
cd ..

# Create the tarball

• Confidence: 95% confidence
• Finding: rm -rf __pycache__ .pytest_cache node_modules .git .venv cd .. # Create the tarball tar -czf contribution.tar.gz -C ./workspace . # Verify it's not too big (max 50MB hard limit) ls -lh contribution.

VirusTotal

62/62 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.