Security audit

Ocean Chat Tool Free

Security checks across malware telemetry and agentic risk

Overview

This P2P chat skill is not clearly malicious, but it asks for broad execution and file authority while its triggers and runtime behavior are under-scoped.

Review this before installing. Use it only for explicit P2P messaging tasks, avoid letting it handle general coding or deployment requests, and confirm where files, keys, and message history will be stored before running any commands. Do not accept files from untrusted peers, and treat the unspecified Python scripts and local signaling server as code that should be inspected separately if provided.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The manifest describes a P2P/WebRTC messaging tool, but the advertised usage scope is broad software engineering assistance such as code generation, debugging, and deployment. This mismatch can cause the agent to invoke the skill in unrelated contexts, expanding its access to read/write/exec capabilities beyond the narrow purpose users would expect.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The skill claims browser-side WASM/WebRTC behavior, but its documented operations depend on local Python execution and a signaling server. This implementation mismatch obscures the real execution model and trust boundaries, increasing the risk that users or agents run local commands and network services they did not anticipate.

Context-Inappropriate Capability

Low

Confidence: 84% confidence
Finding: The skill exposes write and exec capabilities even though its stated purpose is limited to P2P messaging. Unnecessarily broad capabilities increase the blast radius of accidental or malicious invocation, especially when combined with vague triggers and commands that modify local state or receive files.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The trigger language is overly broad and covers routine development activities, making accidental invocation likely. In an agent environment, ambiguous routing can hand read/write/exec access to this skill during unrelated tasks, creating an unnecessary attack surface.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The capability coverage section includes vague generic keywords rather than precise activation constraints. Such broad matching increases the chance that the skill is selected for unrelated prompts, which is especially risky because it has execution and file-modification capabilities.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The documentation describes file transfer and local storage behaviors without clearly warning about local filesystem impact, persistence, or trust risks from received data. Users may unknowingly store sensitive message history or accept files from peers without understanding where data is written and what validation is performed.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: Commands such as receiving files and clearing history can alter or delete local data, yet the skill does not present explicit risk warnings or confirmation requirements. In an agent-driven context, these operations could be triggered with insufficient user awareness, causing data loss or unsafe ingestion of untrusted files.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.