Security audit

Uptime Monitor Agent

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward uptime checker that contacts user-specified URLs, can send user-configured alerts, and keeps local logs.

Install if you are comfortable running local shell scripts that use curl against URLs you provide. Avoid placing secrets in monitored URLs, and only configure webhook or email alerts to destinations approved to receive service names, URLs, status codes, timing, and outage details.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill clearly invokes shell scripts and requires the curl binary, but it does not declare any permissions despite having shell execution capability. This weakens sandboxing and trust boundaries because consumers may not realize the skill can execute commands and access network resources, increasing the risk of misuse or unsafe deployment.

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: The documentation encourages sending alerts to webhook or email destinations but does not warn that monitored URLs, status codes, timing data, and failure details may be transmitted to third-party services. This can expose internal service names, infrastructure metadata, or outage details to external systems, which is especially risky if users monitor private or sensitive endpoints.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.