Security audit

Skillboss

Security checks across malware telemetry and agentic risk

Overview

The skill is a broad AI and deployment gateway, but silent self-updating and under-scoped handling of credentials, project uploads, and auth templates warrant Review before installation.

Install only if you trust SkillBoss/HeyBoss with the data and actions involved. Review or disable the self-update flow, avoid putting real secrets in project config or wrangler vars, use test recipients/accounts for SMS, email, Stripe, and deployments first, and fix the auth template before using it in production.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (24)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The manifest declares only Bash and Read, but the documented behavior clearly expects environment-variable access, network communication, and shell-driven installation/update flows. This mismatch weakens operator understanding of what the skill can really do and can lead to over-trusting a package that performs broader actions than its declared surface suggests.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill is presented as an app-building/AI gateway, but the documented ecosystem behavior includes self-installation into local tool directories, remote updating, credential persistence, host-agent fingerprinting, and additional commerce/account-management actions. That gap is dangerous because users and agents may invoke it for a narrow task while unknowingly granting a much broader trusted execution and data-access role.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The documentation mandates running a local shell update script immediately after seeing an update marker, then re-running the original command. This creates a remote-influenced self-update path that can replace code during normal operation, expanding compromise risk from a single API response or update channel into arbitrary code execution on the host.

Context-Inappropriate Capability

Low

Confidence: 84% confidence
Finding: The skill instructs persistent storage of API credentials in shell profiles and config files, including globally accessible locations. While common operationally, it increases exposure to accidental leakage, credential reuse by unrelated processes, and long-lived compromise if the host is shared or later breached.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: After most normal command executions, the script calls checkForUpdates(), which reaches out to a remote version endpoint and then silently invokes a local shell script via execSync(`bash "${updateScript}"`). This creates an unexpected code-execution path in a tool whose primary role is API brokering, and it can modify the local environment without explicit user approval, materially increasing supply-chain and post-installation risk.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The invocation guidance is extremely broad and covers many common software-building requests, making accidental activation likely. In context, that matters because the skill also supports authentication, payments, deployment, and external API actions, so over-triggering can cause unnecessary credential use, remote calls, or operational changes.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: The manifest description is so broad that it does not meaningfully constrain when the skill should be selected. Because the skill can touch deployment, payments, auth, messaging, scraping, and AI generation, an overly generic description increases the chance of the agent invoking a high-impact integration where a simpler local workflow would suffice.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The examples show sending highly sensitive user data such as audio recordings, phone numbers, OTP verification data, and document URLs to a third-party API without any explicit privacy notice, consent guidance, retention warning, or data-handling caveats. In a skill meant to be embedded into user apps, this can lead developers to unknowingly route regulated or confidential data off-platform, creating privacy, compliance, and trust risks.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The documented `sms-verify`, `sms-send`, `send-email`, and `send-batch` commands can transmit user-provided phone numbers, email addresses, and message bodies to external recipients and third-party services, but the skill provides no warning or consent guidance. In an agent skill context, this is risky because an automated system may invoke these commands with real contact data, causing unintended outreach, privacy exposure, spam, or social-engineering misuse.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The deployment examples and command table document `publish-static`, `publish-worker`, and `stripe-connect` without warning that they can publish local build artifacts, alter live serverless infrastructure, or connect payment configuration. In a multi-capability deployment skill, omission of these warnings increases the chance that an agent or user runs them in the wrong environment and unintentionally changes production systems.

Missing User Warnings

Low

Confidence: 90% confidence
Finding: The documentation instructs users to place a live Mapbox access token in a `.env` file but does not warn that it is a credential that should be excluded from source control and rotated if exposed. While this is common developer guidance, omitting secret-handling precautions increases the chance of accidental token leakage through commits, screenshots, or shared example files.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The tool performs a self-update attempt automatically after successful command execution and runs `install/update.sh` without confirmation, prior warning, or a trust-verification step. In the context of an agent skill that may be run in privileged environments, this is especially dangerous because a compromised update path, tampered local script, or malicious package contents can lead to arbitrary code execution.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: This code accepts a model/API response, extracts a URL from several response fields, then fetches that URL and writes the response body directly to a user-specified output path. Because the URL is not validated against an allowlist, scheme restrictions, or size/content checks, a malicious or compromised upstream service could cause unintended network access and arbitrary file downloads, which is especially risky in a gateway skill that brokers many third-party AI/media providers.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: This command base64-encodes the entire local audio file and sends it to a network-backed model via `run({ model, inputs })`, which means potentially sensitive local content is exfiltrated off-host. In a multi-AI gateway skill, that behavior is expected for speech-to-text, but the lack of any explicit consent, warning, or data-handling boundary in this file makes accidental disclosure of private recordings more likely.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The code automatically reads API credentials from environment variables, a global credentials file in the user's home directory, and local config without any explicit user-facing disclosure or consent step before use. In a multi-AI gateway skill, this increases the risk of silently consuming or transmitting user secrets to external services, especially when invoked by an agent on the user's behalf.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The free-trial provisioning flow automatically sends a header derived from the environment variable SKILLBOSS_E2E_SECRET to a remote endpoint, without any prior disclosure to the user. Transmitting environment-derived secret material is dangerous because environment variables often contain sensitive CI, testing, or platform secrets that should never be exfiltrated implicitly.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The worker publishing path explicitly exempts .env from hidden-file filtering, then recursively reads and uploads included files to a remote build service. It also parses wrangler.toml vars into bindings and sends them in the request payload, which can transmit secrets such as API keys, database credentials, and tokens off-host without an explicit confirmation step or secret redaction.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The workflow instructs the agent to send user-supplied prompts and text to external image, TTS, and video generation providers, but it does not disclose that this content will leave the local environment or advise against submitting sensitive data. In a content-creation skill, users may provide unreleased marketing copy, personal data, or proprietary business information, so the omission creates a meaningful privacy and data-handling risk even if the behavior is functionally expected.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The OTP verification handler returns the entire backend response object (`data`) to the client after successful verification. Since that object includes the `sessionToken`, the session credential is exposed in the JSON response in addition to being set as an HttpOnly cookie, defeating the protection intended by HttpOnly and increasing the risk of token theft via XSS, browser extensions, logs, or frontend error telemetry. In this login integration context, exposing authentication material is more dangerous because this template is intended to be copied into production apps.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The workflow instructs the agent to send user-supplied brand details and prompts to third-party image-generation providers, but it does not warn the user that their inputs will be transmitted externally. This creates a privacy and data-handling risk, especially if users include confidential business information, unreleased branding, or sensitive identifiers in the prompt.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The workflow instructs users to send full script contents to third-party TTS providers but gives no warning that the text leaves the local environment and may contain confidential or regulated information. In a multi-AI gateway skill, that omission increases the chance that users will unknowingly transmit sensitive business, personal, or proprietary content to external services.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The workflow explicitly states that rerunning the deploy command will overwrite the existing live deployment, but it does not require confirmation, backup/versioning by default, or a user-facing warning before replacement. In a website publishing skill, this can cause accidental defacement, loss of previously published content, or unintended production changes if the agent or user targets the wrong project ID.

Credential Access

High

Category: Privilege Escalation
Content: | Location | Path | |----------|------| | Global credentials | `~/.config/skillboss/credentials.json` | | Shell profile | `SKILLBOSS_API_KEY` in `~/.zshrc` or `~/.bashrc` | | Skill config | `config.json` in the skill directory |
Confidence: 90% confidence
Finding: credentials.json

Credential Access

High

Category: Privilege Escalation
Content: | Shell profile | `SKILLBOSS_API_KEY` in `~/.zshrc` or `~/.bashrc` | | Skill config | `config.json` in the skill directory | **Resolution order:** `SKILLBOSS_API_KEY` env var > `~/.config/skillboss/credentials.json` > `config.json` ### When balance is low
Confidence: 90% confidence
Finding: credentials.json

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/api-hub.js:804

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/stripe-connect.js:112

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/lib/client.js:70