Security audit

Picsee Short Link

Security checks across malware telemetry and agentic risk

Overview

This documentation-only skill connects agents to PicSee for URL shortening and link analytics, with expected but important privacy and account-control risks disclosed.

Install only if you trust PicSee with the destination URLs and analytics you ask it to process. Do not shorten URLs containing secrets, tokens, or private query parameters; confirm before letting an agent edit or delete links; and review the migration cleanup commands carefully before running them.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The migration section includes irreversible `rm -f` and `rm -rf` commands that delete files and directories in user home paths without any explicit caution to verify paths, ensure they are obsolete, or back up data first. In an agent-skill context, users may copy-paste cleanup commands verbatim, so destructive commands in documentation can cause accidental local data loss even if the listed paths are intended to be old artifacts.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The QR-code recipe instructs the agent to send the generated short link to `api.qrserver.com`, a third-party service, without warning that link data will be disclosed externally. Even if the short link itself is not highly sensitive in every case, it may embed campaign identifiers, private destinations, or otherwise sensitive metadata, and the omission prevents informed user consent.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The chart-rendering recipe sends analytics data, including click counts and dates, to QuickChart without disclosing that this telemetry is being shared with a third party. In this skill's context, analytics can reveal business activity, campaign performance, and user behavior trends, so silent external transmission creates a real confidentiality risk.

External Transmission

Medium

Category: Data Exfiltration
Content: ## Skill Output - **Transport**: MCP over Streamable HTTP (`https://api.picsee.io/mcp`), or stdio bridge via `npx mcp-remote`. - **Primary output**: `create_short_link` returns `picseeUrl` (the shortened link). - **Analytics output**: structured JSON — overview totals, daily time-series, and breakdowns by platform / referrer / region / audience label. - **Composed recipes (client-side)**: QR code via `api.qrserver.com`; daily-clicks chart via `quickchart.io`.
Confidence: 90% confidence
Finding: https://api.picsee.io/

Tool Parameter Abuse

High

Category: Tool Misuse
Content: rm -f ~/.openclaw/.picsee_token ~/.openclaw/.picsee_salt # 2. Remove the old CLI build artifacts wherever the skill was installed rm -rf ~/.claude/skills/picsee-short-link/cli rm -rf ~/.openclaw/workspace/skills/picsee-short-link/cli rm -rf .cursor/skills/picsee-short-link/cli
Confidence: 85% confidence
Finding: rm -rf ~/.claude/skills/picsee-short-link/

Tool Parameter Abuse

High

Category: Tool Misuse
Content: # 2. Remove the old CLI build artifacts wherever the skill was installed rm -rf ~/.claude/skills/picsee-short-link/cli rm -rf ~/.openclaw/workspace/skills/picsee-short-link/cli rm -rf .cursor/skills/picsee-short-link/cli # 3. Reinstall the v3 skill (see Installation above) and register the MCP server.
Confidence: 85% confidence
Finding: rm -rf ~/.openclaw/workspace/skills/picsee-short-link/

Tool Parameter Abuse

High

Category: Tool Misuse
Content: # 2. Remove the old CLI build artifacts wherever the skill was installed rm -rf ~/.claude/skills/picsee-short-link/cli rm -rf ~/.openclaw/workspace/skills/picsee-short-link/cli rm -rf .cursor/skills/picsee-short-link/cli # 3. Reinstall the v3 skill (see Installation above) and register the MCP server. # 4. Ask the agent to do something authenticated — sign in via browser when prompted.
Confidence: 85% confidence
Finding: rm -rf .cursor/skills/picsee-short-link/

YARA rule 'agent_skill_destructive_autonomous_actions': Autonomous destructive filesystem, shell history, or repository actions in AI agent skills [agent_skills]

High

Category: YARA Match
Content: # 1. Remove the old encrypted token + salt files rm -f ~/.openclaw/.picsee_token ~/.openclaw/.picsee_salt # 2. Remove the old CLI build artifacts wherever the skill was installed rm -rf ~/.claude/skills/picsee-short-link/cli rm -rf ~/.openclaw/workspace/skills/picsee-short-link/cli rm -rf .cursor/skills/picsee-short-link/cli
Confidence: 75% confidence
Finding: rm -f ~/; rm -rf ~/; rm -rf ~/; silently

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

Code: suspicious.destructive_delete_command
Location: README.md:271