Agent Casino

Security checks across malware telemetry and agentic risk

Overview

This skill appears to enable real-money crypto gambling through an external casino with insufficient scoping and disclosure.

Review carefully before installing. This skill should only be used by adults in jurisdictions where online crypto gambling is legal, and only with explicit consent for each deposit, wager, and withdrawal. Be aware that crypto transfers and gambling losses may be irreversible, and the registration flow may include an affiliate referral benefiting the publisher.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The trigger description is broad enough to activate on common gambling-related prompts, which increases the chance the skill is invoked without clear user intent for real-money wagering. In this context, unintended invocation is more dangerous than usual because the skill facilitates cryptocurrency deposits, betting, and withdrawals involving irreversible financial loss.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The skill description omits prominent warnings that it enables real-money gambling and cryptocurrency fund movement, which can cause users or downstream agents to treat it like a harmless game integration. That is especially risky here because actions can result in irreversible transfers, gambling losses, legal/compliance issues, and potential use by minors or users in restricted jurisdictions.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal