Smart Message Plus

• Outcome: Pass
• Latest audit: Jul 17, 2026 · 9:29 AM UTC
• Version: 2.1.0

Overview

This skill is a disclosed enterprise messaging tool with sensitive but purpose-aligned access to messaging APIs, credentials, local config, and send logs.

Install only if you want an agent-accessible tool that can send and recall enterprise messages, create some chat groups, store messaging credentials locally, and keep send/audit logs with message previews. Configure safety_gate admins carefully, use --dry-run for broad sends, protect the data directory, and avoid sending confidential content through approval workflows unless admins are allowed to see the preview.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill describes and instructs use of capabilities including shell execution, network access, reading environment variables, and reading/writing local files, but it does not declare permissions. That mismatch is dangerous because users and enforcement systems cannot accurately assess or constrain what the skill can access, increasing the chance of unintended credential exposure, filesystem modification, or outbound messaging abuse.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The skill description says it is for sending user-provided messages, but this file also supports account provisioning, credential onboarding, contact/group management, recall, and other state-changing administrative operations. This capability mismatch is dangerous because an agent or user may authorize the skill under a narrower trust assumption, while the code can modify persistent configuration and remote messaging resources beyond simple message delivery.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The code can create remote chat groups, save them locally as aliases, and in some cases influence group composition and bot presence, yet this capability is not declared in the manifest description. Undeclared remote resource creation expands the blast radius substantially: a caller expecting only message sending could instead cause new collaboration spaces to be created, members added, and future communications redirected there.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: When the safety gate triggers review, the code sends admins an approval notice that includes a preview of the requested message content and recipient count. This is an undeclared data-sharing behavior that can leak sensitive or confidential message contents to administrators or alternate channels, even if the original sender did not intend broader disclosure.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The code persistently logs message previews, targets, chat identifiers, provider/account metadata, and arbitrary extra fields to a JSONL file without any minimization, redaction, access control, or retention controls beyond entry count. In a messaging skill, these fields can expose sensitive business communications, recipient identities, and routing data to other local users, backup systems, or malware that can read the data directory.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The broadcast audit log stores a preview of the message and a sample of recipients for large sends, creating a durable record of sensitive content and recipient membership. In the context of enterprise messaging and department broadcasts, this can leak internal announcements, personnel relationships, and communication scope even if the primary send operation was otherwise authorized.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.