rtc-work

• Outcome: Pass
• Latest audit: Jun 11, 2026 at 2:19 AM UTC
• Version:
  0.1.1

Overview

This is a coherent RustChain job-market client, but users should be careful with its optional auto-claim and confirmation-skipping modes.

Install only if you intend to interact with the RustChain job marketplace. Review agent.toml, verify the node URL, and avoid combining watch --auto with --yes unless you are comfortable with unattended job claims from the remote feed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The module documentation says watch mode is read-only, but the implementation can issue live claim requests when `--auto` is enabled. This mismatch can mislead users, reviewers, or automation into running a state-changing mode under the false assumption that it is safe, leading to unintended job claims and downstream financial or workflow consequences.

VirusTotal

2/64 vendors flagged this skill as malicious, and 62/64 flagged it as clean.