VPS Fusion Monster Server Test

• Outcome: Review
• Latest audit: May 29, 2026 at 9:25 PM UTC
• Version:
  1.0.0

Overview

This VPS benchmark skill is coherent, but it should be reviewed because it downloads and runs an unverified remote binary and can publicly upload detailed server/network results by default.

Install only if you are comfortable running an upstream binary downloaded at runtime and performing broad external network tests from the target machine. Prefer running as a non-root user on a disposable or test VPS, pass -upload=false unless you intentionally want public result sharing, set CN=false if you want to avoid automatic geolocation checks, and treat --call-ai as sharing raw infrastructure results with the configured AI backend.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 76% confidence
• Finding: The skill documentation advertises shell-based execution behavior but provides no declared permissions or trust boundary information. This creates a transparency and consent problem: users may invoke a skill that can execute shell commands without an explicit permission declaration, increasing the risk of unexpected local command execution when paired with the referenced scripts.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The README gives conflicting execution models: earlier it says the skill runs by downloading and executing a precompiled upstream binary at runtime, while this section describes source-build and local binary workflows as if they were the primary implementation. That mismatch is security-relevant because users and reviewers may wrongly assume they are auditing local source when the actual deployed behavior may fetch and run remote code, weakening trust and reviewability.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README states that results are uploaded to a public paste service by default (`-upload` default true) without a prominent warning about privacy and data exposure. Test output includes system, network, IP-quality, routing, and service reachability data that can reveal sensitive infrastructure details if automatically published.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The markdown explicitly says the skill will automatically download a platform-specific precompiled binary at runtime, but it does not warn users about the supply-chain risk of fetching and executing remote binaries. Executing an opaque downloaded binary can lead to full code execution on the host if the upstream source, mirror, CDN, transport, or release artifact is compromised.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill performs broad network testing, service reachability checks, traceroutes, streaming unlock probes, IP quality checks, and multi-node speed tests, but the description does not clearly warn that it will contact many third-party services. This can expose the user's IP, trigger provider monitoring or rate limits, and generate unexpected traffic or policy violations in sensitive environments.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: When --call-ai is used, the script pipes the full generated prompt to llm, aichat, or ollama. That prompt contains potentially sensitive infrastructure metadata such as public IP address, ASN, location, routing, and service reachability; depending on the backend configuration of those tools, the data may be transmitted to remote model providers without an explicit consent gate or redaction step.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The script automatically downloads the latest remote release binary and executes it locally without any integrity verification, pinning, or explicit user confirmation at runtime. This creates a real supply-chain risk: if the upstream release, CDN path, or transport endpoint is compromised, arbitrary code will be executed on the host under the invoking user's privileges.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script queries third-party geolocation services to infer whether the system is on a China-based network, which discloses the host's public IP and metadata to external services without prominent warning or opt-in. While not code execution, this is a privacy and data-exposure issue that may be sensitive in managed, enterprise, or regulated environments.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The script's documented parameter passthrough exposes an upstream '-upload' capability that may transmit benchmark results externally, but the wrapper does not prominently warn users about potential outbound data transfer. In this context, the danger is increased because all arguments are forwarded directly to the downloaded binary, so users may unknowingly enable remote data submission through inherited upstream behavior.

VirusTotal

64/64 vendors flagged this skill as clean.