Security audit

block-monitor-tool-free

Security checks across malware telemetry and agentic risk

Overview

The skill appears to be a local content-checking helper, but it needs Review because it may save sensitive content previews and has ambiguous callback wording despite claiming local-only handling.

Before installing, treat this as a local exec-capable content moderation helper. Use it only in a controlled working directory, avoid submitting secrets or regulated data unless you are comfortable with local log retention, review or disable preview logging, and clarify callback behavior before providing any callback URL.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The skill claims the free edition is pure local and does not send content externally, yet it documents a callback_url for asynchronous notification. That mismatch can mislead users into providing sensitive content under a false privacy assumption, creating an unintended data exfiltration path if implementations actually call external endpoints.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: Advertising external callback behavior while asserting the tool is purely local creates a trust and privacy boundary violation. In a content-validation skill, users may submit sensitive text specifically because they believe it remains local; any undocumented external notification increases the risk of leakage or compliance issues.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The capability coverage section is excessively broad and can cause the skill to match unrelated or common requests, increasing the chance that an agent invokes exec-enabled workflows in contexts the user did not intend. Because the skill has file and command execution capabilities, overbroad activation expands the attack surface and raises the risk of unanticipated data handling or filesystem changes.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The logging workflow stores content_preview values in local logs without a clear warning, which can persist sensitive user data such as personal information, credentials, or regulated content. In a tool specifically designed to inspect potentially sensitive AI-generated text, silent retention materially increases confidentiality and compliance risk.

Missing User Warnings

Low

Confidence: 87% confidence
Finding: The filtering examples create or overwrite output files containing transformed user data without clearly warning the user. While this is not inherently malicious, it can unexpectedly persist sensitive content to disk, duplicate regulated data, or overwrite files in workflows where users assumed transient processing.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.