7bu uploader

• Outcome: Pass
• Latest audit: May 28, 2026 at 11:01 AM UTC
• Version:
  1.0.0

Overview

This is a simple instruction-only uploader that sends a user-chosen image to 7bu.top using a user-provided token, with no hidden code or persistence.

Install only if you trust 7bu.top with the images you upload. Verify the exact file or URL before invoking the skill, treat the TOKEN like a password, avoid placing it in shared logs or public chats, and rotate it if it is exposed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger format is too loosely specified: it accepts both a local image path or a URL plus a token, without defining trust boundaries, validation rules, or exclusions. In an agent setting, this ambiguity can lead to unsafe behavior such as fetching attacker-controlled remote content, uploading unintended local files, or mishandling sensitive bearer tokens supplied in natural language.

VirusTotal

65/65 vendors flagged this skill as clean.