Manus Monitor

• Outcome: Review
• Latest audit: May 28, 2026 at 9:54 AM UTC
• Version:
  1.0.3

Overview

This Manus helper is mostly related to its purpose, but it adds under-disclosed background monitoring and optional Telegram notifications that can expose task details.

Review before installing. Use it only if you are comfortable with Manus receiving prompts, local task metadata being saved, output files being downloaded locally, and a recurring OpenClaw monitor being created. Check whether TELEGRAM_BOT_TOKEN and TELEGRAM_CHAT_ID are set, because the monitor can send task details and links to that Telegram chat.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The skill explicitly instructs downloading generated files locally and delivering them to the user, but it does not warn that this causes local file writes or that the downloaded artifacts may contain sensitive, malicious, or unexpected content. Because outputs come from an external autonomous agent, treating them as safe by default increases the risk of unsafe storage, accidental exposure, or mishandling of untrusted files.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill directs users to send prompts and retrieve outputs through the Manus external service, but it does not disclose that user data, prompts, and resulting artifacts are transmitted to and processed by a third-party provider. This omission can cause inadvertent sharing of sensitive or regulated information with an external autonomous agent.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: This script silently installs a recurring cron job that runs every minute and persists until it removes itself, without any user confirmation or clear disclosure beyond a console message after creation. In the context of an agent skill that can trigger autonomous actions and notifications, this creates a persistence mechanism that could continue operating unexpectedly, consume resources, and perform ongoing background activity the user did not explicitly approve.

VirusTotal

64/64 vendors flagged this skill as clean.