Security audit

cashu-emoji

Security checks across malware telemetry and agentic risk

Overview

This skill needs review because it combines hidden value-transfer behavior with broad file, command, and API capabilities that are not clearly scoped.

Install only if you intentionally want a skill for handling Cashu token data hidden in emoji and are comfortable granting it broad agent authority. Treat any encoded token text as sensitive value-bearing material, avoid using it in logs or untrusted chats, and prefer a version that removes exec/API access or documents exact commands, services, and consent boundaries.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The skill is presented as a narrow local emoji/Cashu encoder-decoder, but later documentation expands scope to file handling, API usage, and command execution. This scope mismatch is dangerous because it can hide powerful capabilities from users and reviewers, enabling unexpected data access or system-side effects under an innocuous description.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: System command execution is not justified for Unicode-based token encoding/decoding and materially increases the attack surface. If exposed through an agent skill, exec can be abused for arbitrary command execution, local file access, persistence attempts, or chaining with other tools despite the skill's seemingly harmless theme.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: External API integration is not clearly needed for local emoji steganography or token encoding/decoding. Unnecessary network access creates opportunities for token exfiltration, metadata leakage, or hidden dependency on remote services that users would not expect from the stated purpose.

Intent-Code Divergence

Medium

Confidence: 87% confidence
Finding: The documentation claims prior risky code was removed, yet later sections still advertise high-risk capabilities like command execution and API integration. Such contradictory safety claims can mislead reviewers into underestimating the real risk profile and may normalize unsafe trust assumptions.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The skill handles transferable Cashu tokens and explicitly discusses hiding them inside emoji text, but it lacks a clear warning that these tokens may represent bearer value and can be lost, leaked, or covertly transferred. In this context, omission of user warnings increases the chance of unsafe handling and accidental exposure of valuable token material.

Natural-Language Policy Violations

Medium

Confidence: 92% confidence
Finding: The documentation states the process is 'safe' and 'will not leak any sensitive information' without qualification, which is an unjustified assurance for a tool designed to hide value-bearing data in text. This can mislead users into using the skill for sensitive material in contexts where logs, chat clients, normalizers, or external services may expose or transform the embedded token.

Ssd 2

Medium

Confidence: 88% confidence
Finding: The skill explicitly frames the feature as a way to covertly transfer value by hiding Cashu tokens in emoji. Even without exploit code, that positioning is attack-enabling because it supports stealthy movement of bearer assets through channels that may bypass casual inspection or policy controls.

Ssd 2

Medium

Confidence: 86% confidence
Finding: The example use cases normalize steganographic embedding of token data into emoji text, effectively documenting covert payload hiding in ordinary-looking content. In the context of transferable tokens, this increases misuse potential for exfiltration, evasion, or unauthorized movement of value-bearing data.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.