Discount Hunter

Security checks across malware telemetry and agentic risk

Overview

This skill does what it advertises: searches coupon sites and tests promo codes, with clear limits against completing purchases.

Install only if you are comfortable with the agent opening third-party coupon/search pages using the store name or domain from your checkout. Watch the checkout page while it runs; it should only apply promo codes and must not click Pay or submit an order.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill instructs the agent to open hidden tabs and query external coupon/search sites using merchant and checkout-derived context without clearly disclosing that this browsing sends user-contextual data off-site. Even if only the store name/domain is transmitted, that still reveals where the user is shopping and can create privacy leakage, profiling, and unexpected third-party requests from a checkout session.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal