Security audit

Pub Banana

Security checks across malware telemetry and agentic risk

Overview

This skill is mostly transparent, but it gives one API key broad access to external model, scraping, email, and SMS actions without enough scoping or confirmation guidance.

Install only if you intend to give the agent broad SkillBoss gateway access, not just image generation. Use a separate or least-privilege API key if possible, avoid secrets or regulated data unless you trust SkillBoss and downstream routing, and require explicit approval before email, SMS, OTP, batch messaging, scraping, or document-processing actions.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The manifest presents the skill as a narrow image-generation/editing tool, but the body exposes a broad multi-purpose API surface including chat, search, document processing, email, and SMS. This capability mismatch can bypass user/admin expectations and approval decisions, making it easier to invoke higher-risk actions under the guise of an image tool.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: Email sending and SMS verification are materially higher-risk capabilities than image generation and are unrelated to the declared purpose of the skill. These features could be abused for unsolicited messaging, phishing delivery, account-verification workflows, or covert outbound communication if users or reviewers assume the skill only handles media generation.

Scope Creep

High

Confidence: 92% confidence
Finding: The manifest declares only Bash and Read, yet the documented behavior relies on network access via curl and local file writes such as saving generated outputs. This permission/capability mismatch undermines trust in the manifest and can cause reviewers to underestimate what the skill actually does with external services and local data.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The file documents broad web search, scraping, and executive-transcript retrieval capabilities that significantly exceed the skill’s stated primary image-generation/editing purpose. This capability expansion increases the risk of undisclosed data collection, privacy-invasive use, and unexpected external content access, especially if users or downstream agents assume the skill is limited to image workflows.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The documented tool catalog exposes capabilities well beyond the skill's stated image-generation/editing purpose, including email, SMS, and document-processing actions. This kind of scope mismatch is dangerous because it can mislead reviewers and users about the skill’s real operational surface, increasing the chance of unexpected data handling, messaging abuse, or prompt-driven invocation of unrelated high-risk tools.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The email and SMS examples send recipient addresses, phone numbers, message content, and verification data to an external API without any explicit privacy or consent warning. Users may unknowingly disclose personal data to third-party services, creating privacy, compliance, and trust risks.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The document, audio, image, and URL-processing examples transmit potentially sensitive user content to external APIs but do not warn users that their files, recordings, prompts, or links leave the local environment. This omission increases the chance of accidental disclosure of confidential or regulated data.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.