Security audit

Registry Broker

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Registry Broker integration, but it can use an API key to chat with external agents and perform account-affecting actions.

Install only if you trust hol.org and the optional @hol-org/hashnet-mcp package. Use a scoped or temporary API key where possible, do not paste secrets or regulated data into agent chats, avoid logging API keys, keep REGISTRY_BROKER_API_URL pointed at a trusted endpoint, and require confirmation before registration, deletion, inscription, or payment-related actions.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill clearly requires environment access, outbound network access, and shell-based execution examples, but it does not declare corresponding permissions or safety boundaries. This creates a transparency and policy-enforcement gap: a host may expose broader capabilities than a user expects, increasing the risk of unauthorized external calls or secret use such as transmitting the API key to remote services.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: The stated purpose emphasizes discovery, chat, and registration, but the documented behavior also enables wallet authentication, balance checks, registry/platform introspection, and identity resolution. This mismatch can mislead users or orchestrators into approving a skill for low-risk discovery use when it also supports credential issuance, account-linked operations, and additional data access paths.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The manifest presents the skill narrowly, while the content documents broader financial, cryptographic, and persistence-related capabilities such as payment intents, wallet auth, encryption key registration, and content inscription. Understating this scope reduces informed consent and makes it easier for an agent or user to invoke sensitive operations without recognizing their security, privacy, or cost implications.

Missing User Warnings

Low

Confidence: 93% confidence
Finding: The README promotes creating chat sessions and sending messages to external agents but does not warn that prompts, message contents, and related metadata are transmitted off-platform to the registry service and potentially third-party agents. In a skill meant to be consumed by AI assistants, this omission can lead users to unknowingly disclose sensitive data to external services.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill documents operations that can spend credits, create payment intents, update registrations, and delete or unregister resources without prominent warnings or confirmation requirements. In an agentic environment, this can lead to unintended financial charges or destructive account changes if a user request is ambiguous, prompt-injected, or automatically executed.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The chat, routing, inscription, and related examples send potentially sensitive prompts, metadata, content, and session history to external services but do not warn about privacy, retention, or third-party data handling. This increases the chance that users or calling agents disclose secrets, proprietary data, or personal information to remote systems without realizing the transmission scope.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The example prints a temporary API key directly to stdout, which can expose credentials through terminal scrollback, shell history capture, CI logs, remote session recording, or centralized log collection. Even though this is sample code and the key is temporary, users commonly copy examples into real workflows, making accidental credential disclosure a realistic risk.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The API reference documents many state-changing and destructive endpoints such as route, chat, register, update, unregister, and delete operations, but does not warn users that these actions can incur costs, send messages to third parties, alter registrations, or permanently remove data. In a skill intended for agent discovery, chatting, and registration, this omission increases the chance an autonomous agent or user will invoke sensitive operations without informed consent or adequate guardrails.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The documentation shows users how to place sensitive secrets such as REGISTRY_BROKER_API_KEY directly into configuration and also lists HEDERA_PRIVATE_KEY as an environment variable, but it does not warn about secure storage, least-privilege handling, redaction, or avoiding committing secrets to disk. In the context of an MCP server that enables authenticated registry operations, chat, registration, and payments, exposed credentials could let an attacker impersonate the user, spend credits, register agents, or abuse linked payment capabilities.

VirusTotal

61/61 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: examples/ledger-auth.js:10

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: examples/register-agent.js:10

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: examples/search-and-chat.js:11