Security audit

Deals Hunter

Security checks across malware telemetry and agentic risk

Overview

This deal-hunting skill mostly matches its purpose, but it hard-codes local files and Discord destinations in ways users may not control.

Review before installing. Configure or remove the hard-coded Discord channel IDs and /Users/xufan65 paths, confirm where posts will go, and run it once in a dry-run or sandboxed environment before granting Tavily or Discord access.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The README overstates the skill's behavior by advertising 20 recommendations and processing 40 source items, while the stated skill scope says only the top 5 items receive historical-price checks to stay within quota. This kind of documentation drift can mislead operators about API usage, cost, data processing volume, and runtime behavior, which is a real security and reliability issue when users grant automation broader trust than intended.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The README claims the skill provides historical low-price information, but later says users must visit external pages to see it and that automatic history lookup is still pending. This inconsistency can cause users to overtrust the output as verified pricing intelligence when it is actually indirect or incomplete, increasing the risk of poor purchasing decisions and unsafe automation assumptions.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The prompt behavior exceeds the skill metadata’s stated limit of historical-price queries for only the first 5 items, creating a mismatch between declared and actual data-access scope. This is dangerous because operators and users may rely on the manifest’s tighter resource/privacy expectations while the prompt silently performs broader enrichment work, increasing third-party exposure and quota consumption.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: Requiring 8–12 fully enriched deals conflicts with the manifest’s narrower design and effectively pressures the agent to perform more external queries than disclosed. The risk is primarily integrity and governance-related: the skill may violate cost-control assumptions, rate limits, or review expectations because its operational scope is broader than advertised.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The prompt explicitly directs Tavily searches for every item, contradicting the manifest’s promise to limit lookups to the top 5 with 24-hour caching. In this skill context, repeated scheduled runs amplify the issue by causing unnecessary third-party requests, potential quota exhaustion, and broader external transmission of deal-related search terms than users or reviewers would expect.

Intent-Code Divergence

Medium

Confidence: 86% confidence
Finding: The documentation claims RSS plus Tavily verification but omits the promised 24-hour cache control, which understates the frequency and breadth of external searches. This weakens transparency and makes the scheduled skill more dangerous operationally because repeated executions can generate more outbound requests than the documented design suggests.

Description-Behavior Mismatch

Low

Confidence: 82% confidence
Finding: The skill replaces the original RSS deal link with third-party purchase links discovered from search results, which changes the trust boundary and can redirect users to unintended domains. Because these links come from external search content with minimal validation, users may be steered to affiliate, spoofed, or otherwise unsafe destinations.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill reads and later updates a persistent local file under the user workspace without clearly warning that it will modify durable local state. This is risky because it can surprise users, create unintended retention of browsing/deal history, and normalize silent writes to local files in an agent context where filesystem actions may be sensitive.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The prompt instructs sending content to Discord without an explicit warning that data will be transmitted to an external service. In an automation skill, undisclosed outbound posting is dangerous because users may not realize content, links, or derived shopping preferences are being shared to a third-party platform and channel.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill sends deal titles and derived search queries to Tavily without explicit disclosure or consent, creating an external data-sharing path. Even if the content seems low sensitivity, outbound transmission to a third party expands exposure and may leak user interests, tracked items, or proprietary feed-derived data.

VirusTotal

No VirusTotal findings

View on VirusTotal

Static analysis

No suspicious patterns detected.