Security audit

Apollo Immu

Security checks across malware telemetry and agentic risk

Overview

This skill is a local safety interceptor, but its automatic trust learning can reduce confirmations for sensitive actions based on weak conversation cues.

Review this carefully before installing. It does not show exfiltration or destructive hidden behavior, but you should only use it if you are comfortable with a persistent trust database and automatic learning that may reduce prompts for sensitive actions. Prefer disabling conversational auto-learning or keeping explicit confirmation for sends, command execution, permission changes, and non-temporary deletes.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill invokes shell commands and reads/writes local files (`scripts/interceptor.py`, `scripts/trust_tracker.py`, `assets/trust_db.json`) without declaring permissions. This creates hidden capability exposure: a host or reviewer may treat the skill as low-privilege while it can actually execute commands and persist state, which is especially risky because the trust database influences future security decisions.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The skill is presented as a protective interceptor, but it also profiles conversation style to infer relationship closeness, auto-adjusts trust, and persists recipient-specific trust history. That mismatch is dangerous because users may consent to a safety tool without realizing it performs behavioral inference and durable trust state changes that can silently weaken future confirmation barriers.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The document explicitly allows auto-approving actions such as sending messages after only three prior approvals, and bases that trust partly on weak conversational cues. In a security skill, reducing confirmation for outbound communication without strong identity, scope, and data-sensitivity checks can lead to unauthorized disclosure, social-engineering amplification, or messages sent to the wrong recipient.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The interceptor silently modifies long-term trust state based on message content, without any user-facing disclosure or consent. In a security control, hidden state changes are dangerous because they let ordinary conversation gradually suppress future confirmations, reducing the effectiveness of the guardrail without the user's awareness.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: Reading contextual message content from an environment variable without disclosure creates a covert input channel into a security decision. That makes interception behavior depend on hidden conversational data, which can surprise users and expands the attack surface if upstream components can set or manipulate INTERCEPTOR_CONTEXT.

Ssd 4

High

Confidence: 99% confidence
Finding: The file defines a trust-building mechanism that lowers safeguards for future risky actions based on informal signals like relaxed tone, short replies, and prior approvals. These heuristics are easy to spoof and unsafe to generalize across changing contexts, allowing an attacker or a misclassified conversation to bypass confirmations for sensitive operations.

Ssd 4

Medium

Confidence: 96% confidence
Finding: The skill lowers scrutiny based on weak conversational heuristics such as short replies, filler words, or casual tone, and can automatically increase trust before evaluating risky operations. In this context—a security interceptor—that is especially dangerous because an attacker can mimic 'intimate' language to train the system into auto-allowing sensitive sends or executions.

VirusTotal

67/67 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.