Security audit

Bot Customizer

Security checks across malware telemetry and agentic risk

Overview

This skill is not clearly malicious, but it needs Review because it stores plaintext credentials and makes persistent agent/configuration changes without enough user control.

Install only if you are comfortable with a skill that can rewrite agent instructions, rename workspaces, edit EasyClaw configuration, and store secrets in a local plaintext .env file. Do not paste real passwords, tokens, or API keys into this workflow; use a secure secret manager or placeholders instead, and review or back up AGENTS.md and easyclaw.json before allowing changes.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The skill’s stated purpose is to customize AGENTS.md instructions, but it explicitly authorizes extracting user-supplied credentials and persisting them into a .env file. This expands scope from text customization into secret handling without a clear necessity, creating a high risk of credential exposure, misuse, or unintended retention in the workspace.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The manifest describes a skill for customizing AGENTS.md, but the workflow also renames workspace directories and edits the global easyclaw.json agent configuration. This hidden scope expansion can cause unintended system-wide changes, break references, or let a user request modifications beyond what the skill transparently advertises.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The skill instructs the agent to store sensitive user-provided credentials in a .env file and even says they should not be rejected, but gives no warning about retention, exposure, or security consequences. In this context, lack of warning is especially dangerous because the skill directly handles high-value secrets and normalizes unsafe persistence as expected behavior.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The workflow performs impactful actions—modifying AGENTS.md, renaming workspace directories, and editing configuration files—without clearly warning the user in the skill description or requiring confirmation. This can lead to surprising persistent changes, misconfiguration, or accidental disruption of agent behavior and filesystem layout.

Ssd 3

High

Confidence: 99% confidence
Finding: The skill explicitly tells the agent to extract secrets such as passwords, API keys, and tokens from user input and persist them into files for later use. That behavior creates a direct secret exfiltration and retention risk: secrets may be exposed through logs, backups, file access, workspace sharing, or later unintended processing by other tools.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal