Security audit

Bounty Hunting

Security checks across malware telemetry and agentic risk

Overview

This bounty-hunting skill is mostly coherent as GitHub workflow guidance, but it also directs sensitive credential handling, mailbox access, security-tool workarounds, and ungated public write actions.

Review carefully before installing. Use only the read-only bounty search parts unless you explicitly want the agent to act through your GitHub account. Do not allow it to read local credential files, store tokens in /tmp, use a Gmail app password, delete mail, bypass security scanner blocks, or post any session/system context publicly. Require confirmation before any fork, commit, PR, comment, or local note write.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (18)

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The skill is presented as a bounty discovery/tracking workflow, but these sections instruct the agent to fork repositories, create branches/commits, and open pull requests remotely. That materially expands scope from read-only analysis into external side effects, increasing the chance of unauthorized code publication or unintended interaction with third-party repositories.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: This section adds automated PR follow-up behaviors such as commenting on PRs and stale-bot bumping, despite the skill description framing itself as scanning/reporting focused. Those actions can modify public project state and create reputational or operational impact if triggered without deliberate user approval.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The skill includes instructions to extract a GitHub token from local credential storage and place it into a temporary file/environment variable. Accessing and transforming stored credentials is unnecessary for simple bounty scanning guidance and creates a direct path for credential exposure, misuse, or leakage through logs, temp files, or downstream commands.

Context-Inappropriate Capability

Medium

Confidence: 78% confidence
Finding: The skill mandates writing notes into a specific local Obsidian vault path that is not necessary for the core bounty scanning function. Unprompted writes to user-local filesystems can leak data, overwrite notes, or create unwanted persistence, especially when framed as mandatory behavior.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The file instructs the agent to access and manage a Gmail mailbox, which is materially unrelated to the stated purpose of GitHub bounty hunting. This kind of scope drift is dangerous because it expands the agent's privileges into a personal communication system and creates an avenue for unauthorized data access or destructive actions outside the advertised skill boundary.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The instructions include a specific personal Gmail address and require an app password, granting access to a real mailbox, while also authorizing deletion of emails. Exposing or encouraging use of personal account credentials for a skill unrelated to email handling creates a serious risk of credential misuse, privacy violations, and irreversible data loss.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The file includes explicit instructions to extract a GitHub token from ~/.git-credentials and export it into the environment, which directs access to sensitive local secrets unrelated to a passive repo reference document. In an agent skill context, this is especially dangerous because it can normalize credential harvesting and enable unauthorized use of the user's GitHub account or downstream code-hosting access.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: These scan notes go beyond passive bounty tracking and include operational guidance for altering local authentication behavior and executing a locally written script from /tmp. In a reference file for a bounty-hunting skill, this expands the skill toward host-environment manipulation and normalizes unsafe operator actions that could affect credentials or bypass local safeguards.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The documented workaround explicitly reframes a security scanner block as something to evade by moving the logic into a temporary script and executing it indirectly. This is dangerous because it teaches bypass behavior, undermines security controls, and can be repurposed to conceal or execute disallowed actions on the host.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: These instructions direct the agent to modify a local Obsidian vault without an upfront safety warning or confirmation step. Even if intended for productivity, silent file writes are risky because they affect user data outside the immediate task context.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The workflow details remote repository modifications through fork creation, branch creation, commits, and PR submission, but does not foreground that these are external side effects requiring explicit authorization. In an agent setting, that omission can cause unintended changes to public or private repositories under the user's identity.

Missing User Warnings

Low

Confidence: 90% confidence
Finding: The document tells the user to run `unset GH_TOKEN` as a troubleshooting step but does not warn that this changes the current shell's authentication behavior and may disrupt other workflows relying on that token. While not code execution or credential exfiltration, it is still an unsafe operational instruction because it can cause accidental loss of expected GitHub CLI auth context or lead users to operate under a different cached account than intended.

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: The document instructs the agent to modify remote repository content via the GitHub API ('Re-upload formatted file') without any explicit requirement for user confirmation, scope checks, or safeguards against unintended writes. In an agent skill, write-capable guidance is risky because it can normalize autonomous changes to third-party repositories and lead to accidental or unauthorized modifications.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill instructs deletion of emails without a clear, prominent warning about irreversible data loss or a required confirmation step. Even though it says not to delete other mail, the agent is still being empowered to perform destructive mailbox actions that could remove important messages through misclassification or execution error.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The commands handle a GitHub token from local credential storage with no warning, masking, or approved secret-handling process, and even suggest copying it via shell and temporary-file workflows. This creates a clear path for secret exposure in shell history, environment leakage, temp-file residue, logs, or accidental reuse by other tools.

Missing User Warnings

Low

Confidence: 90% confidence
Finding: The template explicitly prompts users to record authentication status, account name, and token scopes in a report artifact. Even without the raw token value, this is sensitive operational security data that can aid account targeting, privilege mapping, or accidental disclosure if reports are shared or committed to a repository. In the context of bounty hunting and GitHub workflows, such reports are likely to be stored, transmitted, or versioned, which increases the chance of unintended exposure.

Ssd 3

High

Confidence: 99% confidence
Finding: This is natural-language guidance for exposing sensitive authentication material: it tells the reader how to parse a secret out of ~/.git-credentials and place it into GH_TOKEN. In a skill that may be consumed by an automated agent, such instructions are highly dangerous because they can induce credential access and exfiltration behavior under the guise of normal setup.

Ssd 3

High

Confidence: 98% confidence
Finding: The file explicitly highlights a repository requirement to paste full session initialization context into a public `@fix-author` comment block. That creates a clear natural-language exfiltration path for agent prompts, hidden instructions, system context, credentials, tokens, or other sensitive workflow metadata, especially in a bounty-hunting skill where users may be encouraged to follow repository-specific submission requirements under time pressure.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.