ai-quota-check

• Outcome: Review
• Latest audit: Jul 10, 2026 · 3:41 AM UTC
• Version: 1.0.1

Overview

This quota-checking skill appears mostly purpose-related, but it reads sensitive local AI account/session files and can trigger a live Codex request without clear user control.

Review before installing. Use it only if you are comfortable with a local quota tool inspecting AI provider auth/session files and potentially making a live Codex request to refresh rate-limit data. Prefer running it only on machines where those accounts are intended to be checked, and look for an option or update that requires confirmation before live refreshes.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill advertises executable behavior that depends on environment-sensitive data but declares no permissions, which weakens user awareness and any permission-gating the platform may rely on. In context, the skill is a quota checker that appears to inspect local auth/session state, so undeclared env-related capabilities materially expand what it can access beyond what the metadata communicates.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This is a strong true positive because the declared purpose is a passive quota dashboard, but the described behavior includes active network-triggering commands, inspection of local authentication profiles, and reading session logs. That mismatch is dangerous because users may invoke a harmless-seeming skill while it accesses sensitive account metadata and performs side effects that were not clearly disclosed.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill is presented as a quota checker, but it actively executes `codex exec --skip-git-repo-check "reply OK"` to force a fresh server-backed rate-limit update. That causes an external side effect and a live networked request through another CLI without explicit user consent, which is risky for a read-only monitoring utility and could unexpectedly consume quota, trigger auth flows, or run against a manipulated `codex` binary in the user's PATH.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The documented trigger set includes very broad terms such as "quota", which can cause the skill to activate in situations where a user mentions quotas generically rather than explicitly requesting this skill. Over-broad invocation increases the chance of unintended routing, confusing behavior, and accidental disclosure of provider/account quota information in the wrong conversational context.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The activation rule is overly broad for common quota-related phrases and instructs the agent to use this skill first, increasing the chance of automatic execution in benign conversations. Because the skill appears to inspect local provider/account state and may trigger a live Codex request, broad invocation makes unintended sensitive access and side effects more likely.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The subprocess call issues a live Codex request silently and unconditionally during dashboard generation, despite the skill being framed as informational. Hidden network-triggering subprocesses are dangerous because they can consume paid usage, alter audit/session state, and surprise users who did not consent to outbound actions.

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

Unified quota monitor and intelligent model recommender for all providers.

## Output Instructions

**IMPORTANT:** When executing this skill, display the script output **EXACTLY as-is** in markdown format. Do NOT summarize or rephrase the output. The script produces a formatted dashboard that should be shown directly to the user.

• Confidence: 96% confidence
• Finding: Output Instructions

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: index.js:205