Asb

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward ASB MCP integration, with no evidence in the artifact of hidden data access, exfiltration, or destructive behavior.

Before installing, review and trust the upstream Agent-Service-Bus package because the skill delegates runtime behavior to external Python code. Treat LLM calls and message sending as potentially outbound, and avoid sending sensitive data until you understand the configured providers and destinations.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill explicitly advertises `llm-provider` and `message-send` capabilities, which imply data may be transmitted to external models or messaging endpoints, but it does not warn users about possible outbound communication, data sharing, or privacy implications. In an agent/MCP context, this omission is security-relevant because users may provide sensitive prompts or documents without realizing they could leave the local environment.

VirusTotal

No VirusTotal findings

View on VirusTotal