agentkey

• Outcome: Review
• Latest audit: Aug 6, 2026 · 5:54 PM UTC
• Version: 1.0.7

Overview

This API-key skill needs Review because it promises local-only privacy while bundled docs add external service use, silent telemetry, update commands, persistence files, and bearer-token setup.

Review carefully before installing. Only use it if you are comfortable connecting to the hosted AgentKey MCP service, contacting provider APIs for key tests or rotation, allowing update checks/possible update commands, and protecting any bearer token placed in local agent config. Disable or avoid telemetry/update behavior if your environment requires strict no-egress credential handling.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill claims highly sensitive local key management but does not declare permissions while static analysis detected shell capability. Undeclared shell access in a credential-handling skill is dangerous because it can invoke arbitrary local commands, access files containing secrets, or stage exfiltration without informed user consent.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented behavior promises complete privacy and that keys never leave the machine, yet the analyzed behavior includes GitHub API release checks, config-file manipulation, telemetry-related status emission, and update logic. In a security tool managing API keys, this mismatch is especially dangerous because users are likely to trust strong privacy claims while the skill performs network and auxiliary behaviors that expand the attack surface and could leak metadata or enable future secret exposure.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The README makes an absolute claim that keys 'NEVER leave your machine,' but the same document elsewhere states provider APIs are contacted during rotate/test operations. Even if only the submitted key is sent to the provider, that is still credential material leaving the machine, so the statement is misleading and can cause unsafe operator assumptions about network exposure and secret handling.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: This maintenance document adds self-update, prompting, telemetry, and local state-management behavior that is materially outside the skill’s declared API key management purpose. That scope expansion is dangerous because it grants the skill authority to execute commands, contact external services, and modify user state under the guise of maintenance, increasing the attack surface and creating opportunities for supply-chain abuse.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The file instructs the agent to forward upgrade telemetry through an internal tool silently and on a best-effort basis, without making that data flow visible to the user. Even if the fields seem operational, undisclosed telemetry creates privacy and trust risks and can normalize covert outbound data transmission from a security-sensitive skill.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The document authorizes command execution for self-upgrade, including server-provided update commands and `npx skills update agentkey`, which creates a direct remote-command and supply-chain execution path. In a key-management skill, this is especially dangerous because compromise of the update channel could lead to arbitrary code execution in the same environment that handles secrets and configuration.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The README presents an absolute privacy guarantee that conflicts with documented provider API interactions. Conflicting security claims in credential-management tooling are dangerous because users may rely on the stronger claim, use the tool in restricted environments, or skip network/secret reviews under false assumptions.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Telemetry forwarding is explicitly designed to be silent and to suppress errors, which means users may never know that operational data is being transmitted. Lack of user-facing notice and consent is a security and privacy problem, particularly for a skill marketed around secure key management where users expect minimal undisclosed data egress.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The API-key fallback instructs users to place a bearer token directly into agent configuration but does not warn that this token is a secret, should be stored in a secure secret store, and must not be committed to source control, logs, or shared config files. In the context of a key-management product, this omission is especially risky because users may copy long-lived credentials into insecure locations, enabling unauthorized access to the hosted MCP server if the config is exposed.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.