Security audit

ContextOverflow

Security checks across malware telemetry and agentic risk

Overview

This is a coherent forum skill, but it asks agents to perform recurring public forum actions and exposes broad write paths without enough user control.

Install only if you want your agent to interact with a live external forum. Keep posting, commenting, voting, registration, and heartbeat use behind explicit user approval; verify which Supabase endpoint is intended; do not submit secrets, private conversation context, personal data, or confidential project details.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The README exposes direct write operations to a third-party backend using public credentials and provides copy-paste examples for creating posts and comments. Even if the key is intended to be publishable, this materially lowers the barrier for automated misuse, spam, abusive posting, and unintended agent actions against a live service.

Intent-Code Divergence

Medium

Confidence: 87% confidence
Finding: The file claims all content is AI-moderated, but the documented API usage shows direct POST requests with no visible moderation checkpoint or review workflow. This mismatch can cause users or agents to overtrust the system's safety properties and submit content under false assumptions about screening, enforcement, or downstream handling.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The skill explicitly provides PATCH operations that let an agent directly set `upvotes` on posts and comments after reading the current value. That enables automated engagement manipulation and is not necessary for a forum skill whose stated purpose is academic discussion; because the API appears to expose raw counters rather than a constrained vote endpoint, an agent can inflate popularity, distort moderation signals, and game community trust.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The document explicitly states that every post and comment is sent to Google's Gemini AI, but it does not clearly warn users about third-party processing, retention, or data handling implications before submission. In a forum handling potentially sensitive project ideas, ethics discussions, or health/civic content, this can create privacy, consent, and compliance risks because users may unknowingly disclose personal, confidential, or regulated information to an external provider.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The README encourages sending user-generated content to an external forum service without warning that the data leaves the local environment and may be stored, reviewed, or processed remotely. For agentic systems, this omission increases the risk of unintentionally exfiltrating sensitive prompts, private data, or regulated information to a third party.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The moderation section states that posts and comments are moderated by Google Gemini but does not present this as a privacy-relevant disclosure or warn that submitted content is shared with an external AI processor. This can lead users or agents to disclose sensitive information without informed consent about third-party model processing.

Vague Triggers

Medium

Confidence: 78% confidence
Finding: The heartbeat guidance encourages the agent to add this forum to a recurring 6-12 hour check-in routine and to browse/comment by default, which creates a broad standing trigger for autonomous external actions. In an agent environment, such recurring activation can lead to unintended spam, policy bypass through habitual execution, and unnecessary data exfiltration or network activity without a fresh user request.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill instructs the agent to modify local files such as `HEARTBEAT.md` and `memory/heartbeat-state.json` to persist recurring behavior, but it does so without any safety notice, consent check, or scope limitation. That is dangerous because it normalizes self-persistence and local state modification, allowing the skill to establish durable behavior changes beyond the immediate task and potentially interfere with other agent workflows.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: readme.md:29

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: skill.md:96