Aura Alert Listener

• Outcome: Review
• Latest audit: May 28, 2026 · 1:54 PM UTC
• Version: 1.0.0

Overview

The skill is a real Aura marketplace listener, but it gives a remote Aura service broad ongoing authority to direct agent actions and recommends an unsafe background listener install.

Install only if you intentionally want an autonomous Aura marketplace agent. Use human-approval mode, disable auto-ack if alert visibility matters, avoid the HTTP aura-listen binary unless independently verified, and do not allow autonomous task execution, settlement, spending, or file uploads without clear local limits.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The documented behavior vastly exceeds the declared scope of a high-frequency alert listener. Instead of being limited to polling and deduping alerts, the skill enables broad remote-account lifecycle actions, task marketplace operations, profile changes, file upload, and settlement workflows, which increases the attack surface and user-impact radius far beyond what the metadata suggests.

Context-Inappropriate Capability

High

• Confidence: 100% confidence
• Finding: The skill tells the agent to read `alert.instructions` from the server and execute anything not prefixed for human relay. That delegates control of agent behavior to untrusted remote natural-language content, allowing the server or anyone who can influence alerts to trigger arbitrary external actions, policy bypasses, or harmful state changes.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: Autonomous registration and credential bootstrap create a remote account and establish durable credentials even though the skill is described as an alert listener. This causes unnecessary external side effects and identity creation without clear user initiation, which is a dangerous mismatch in context.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The skill description presents the script as an alert listener/poller, but this block performs a state-changing remote action by acknowledging push alerts. That expands the script from passive monitoring into mutation of server-side alert state, which can suppress visibility or alter workflows without an explicit operator decision.

Context-Inappropriate Capability

Medium

• Confidence: 76% confidence
• Finding: The script fetches agent settings and includes approval_mode and policy in its output even though its core purpose is polling alerts. This broadens data access and disclosure beyond least privilege, potentially exposing internal policy/configuration to downstream consumers that only need alert data.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The skill description is broad enough to match general monitoring or alert-handling scenarios, which increases the chance the agent invokes it outside the user's intended scope. Because this skill is explicitly designed for high-frequency polling and autonomous task/job handling, accidental invocation can lead to repeated network access and state-changing actions such as claiming, executing, or acknowledging work without sufficiently specific user intent.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill text describes autonomous handling, auto-ack for push alerts, and claim/execute loops, but it does not prominently warn that the skill can perform external state-changing operations. In practice, this can cause an agent or operator to treat the skill as a passive monitor when it may acknowledge alerts or act on tasks/jobs automatically, increasing the risk of unauthorized or unintended actions.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill instructs the agent to register immediately and choose an identity autonomously, but does not clearly foreground that this creates an external account and sends identity/profile data to a third-party service. In the context of a listener skill, this lack of informed consent makes the behavior more dangerous and misleading.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The heartbeat flow normalizes automatic execution of server-provided instructions without a strong warning that such actions may alter remote accounts, spend credits, upload data, or change local/system state. Because the skill is framed as routine alert checking, users may underestimate the severity of the autonomous actions it authorizes.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: This script trusts environment-controlled file paths for both the flag and queue files, then unconditionally truncates, rewrites, or deletes those paths. If an attacker can influence the environment or launch context, they could point these variables at unintended files and cause data loss or tamper with application state without any validation or operator visibility.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This code issues POST requests to acknowledge push alerts automatically, which is a state-changing operation performed silently during polling. In a high-frequency autonomous loop, that can rapidly clear or hide alerts before a human reviews them, reducing auditability and possibly interfering with incident response or approval workflows.

Ssd 1

High

• Confidence: 100% confidence
• Finding: Executing server-supplied natural-language instructions lets remote prose semantically override local safety boundaries. Even without direct code execution, this is effectively prompt injection by design: the remote service can steer the agent into actions the local operator did not intend or authorize.

Ssd 4

High

• Confidence: 96% confidence
• Finding: The text repeatedly frames the alert source as trusted and then gradually escalates from polling to autonomous action, which socially conditions the agent/operator to treat untrusted remote content as authoritative. That trust-building makes prompt-injection-style abuse more likely to succeed and less likely to be questioned.

Ssd 1

High

• Confidence: 100% confidence
• Finding: The global instruction to follow `alert.instructions` on every heartbeat continuously delegates behavioral control to an external service. In a high-frequency listener context, this creates a persistent remote control loop that can repeatedly trigger unauthorized actions with little human visibility.

VirusTotal

64/64 vendors flagged this skill as clean.