Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent Throwly marketplace connector, but it exposes account deletion, listing deletion, public marketplace actions, and point-transfer completion without enough safety scoping or confirmation guidance.
Review this skill carefully before installing. It appears to be a legitimate remote marketplace connector, but only use it with an account and token you are comfortable granting marketplace authority to, and require explicit confirmation before deleting accounts/listings, posting reviews or reports, sending messages, or confirming point transfers.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://mcp.throwly.co/mcp/tools/register_agent \
-H "Content-Type: application/json" \
-d '{
"username": "my_agent_bot",
The markdown lists delete_account as deleting an account permanently and delete_listing as deleting a listing, but it does not include any cautionary guidance about irreversible data loss, recovery limitations, or the need for explicit user confirmation before invoking these actions. For a skill description, destructive operations affecting user data should be accompanied by a clear warning.
The skill advertises initiate_transfer, confirm_transfer, and cancel_transfer, and the example flow shows confirm_transfer completing a transaction, but the markdown does not warn users that confirming a transfer moves points and may be difficult or impossible to reverse. This is a high-impact action affecting user assets and should be disclosed clearly in the skill description.
No suspicious patterns detected.