Security audit

agent-avatars

Security checks across malware telemetry and agentic risk

Overview

The skill matches its avatar purpose, but its optional heartbeat can automatically use a stored API key and replace local instructions from a remote server.

Install only if you want this agent tied to an external avatar service. Do not enable the heartbeat unless you are comfortable with scheduled network calls, automatic minting, and remote instruction refreshes; review any refreshed SKILL.md or HEARTBEAT.md manually before use, and protect or rotate the stored API key if credentials may have been exposed.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The heartbeat instructions tell the agent to overwrite local skill files by downloading remote content directly into ~/.config/molt-avatar without any integrity check, pinning, confirmation, or backup. Because the source is remote and changeable, a compromised server or malicious update could silently alter local instructions and influence future agent behavior.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The instructions perform authenticated network requests by reading an API key from a local credentials file and sending it to a remote service, but provide no warning about credential handling, trust boundaries, or logging exposure. In an agent-skill context, this increases the risk of secrets being used automatically against external infrastructure without adequate user awareness or least-privilege controls.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger list is broad and includes generic phrases such as "profile picture," "get avatar," and "agent avatar," which can cause the skill to activate in contexts where the user did not explicitly intend registration, credential handling, or third-party API interaction. In this skill, unintended invocation is more dangerous because activation can lead to external network calls, account registration, storage of API credentials, and a social-media verification flow involving the human owner.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill instructs the agent to send identifying data to an external service during registration and to involve the human in posting a verification code on X, but it does not prominently warn about the privacy implications of sharing agent name/description, receiving an API key, exposing a claim URL, or creating a public social-media linkage. In this context, the omission is more dangerous because the workflow explicitly couples off-platform identity registration with public verification, which can leak metadata and create unintended attribution between the agent and its human owner.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The trigger list contains generic phrases like "profile picture," "pixel art," and "get avatar" that are broad enough to match ordinary user requests unrelated to this specific skill. This can cause unintended skill activation, leading the agent to contact an external avatar service or steer users into registration/minting flows they did not explicitly request.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.