Security audit

one-click dev and dploy

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed web deployment helper that can modify project files and use GitHub/Cloudflare, but the behavior matches its stated purpose.

Install only if you want an agent-assisted tool that can change local project files and use your GitHub and Cloudflare accounts. Before running it, confirm the project name, source directory, whether --in-place is used, whether to add --skip-github or --skip-deploy, and use a least-privilege Cloudflare token scoped to the intended account.

SkillSpector

By NVIDIA

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill clearly relies on environment access and networked operations such as GitHub/Cloudflare interaction, but it does not declare corresponding permissions in structured metadata. That mismatch weakens auditability and user consent because a host system may underestimate what the skill can read or transmit, especially around tokens and deployment actions.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documented behavior understates several high-risk actions: repository creation, remote push, config and env reading, possible file overwrites, and automated content modification/retry flows. Even though the prose mentions confirmations, the static finding indicates the implemented behavior exceeds the declared scope, which can lead users to authorize a deployment helper that actually performs broader and more destructive changes.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The tool metadata claims safety confirmations for overwrite, Git push, and system-modifying actions, but the implementation proceeds directly into creating directories, copying files with force enabled, initializing Git, pushing to remotes, and deploying without an explicit approval gate. In an automation/deployment skill, this mismatch is dangerous because users may rely on the advertised safeguard and unintentionally trigger destructive or externally visible actions.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The 'fixIssues' step does more than passive validation: it can create index.html, stage changes, create a commit, and push to a remote repository automatically. That stronger side effect is risky because it mutates project contents and publication state after a failed test, without a fresh user decision at the point of remediation.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.exposed_secret_literal

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: deploy.js:137

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: deploy.js:74

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: deploy.js:551