Security audit

Remnawave Robot

Security checks across malware telemetry and agentic risk

Overview

The skill is a real Remnawave account-admin tool, but it exposes and persists sensitive VPN and email credentials too broadly for automatic installation.

Review this before installing. Only use it in a controlled admin environment, rotate any exposed subscription URLs found in the package, avoid committing generated .env/config/log files, and prefer a version that redacts subscription links, removes hard-coded recipients, stores secrets in a proper secret store, and keeps TLS verification enabled unless you have a managed trust setup.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The documentation claims SMTP passwords are encrypted, but the example shows the secret stored directly in plaintext JSON under config/smtp.json. This creates a real risk of credential disclosure through local file reads, backups, logs, or accidental commits, and it can mislead operators into treating an insecure storage pattern as safe.

Intent-Code Divergence

Medium

Confidence: 84% confidence
Finding: The security section says sensitive operations require secondary confirmation, but the documented delete command appears to perform direct account deletion with no visible confirmation safeguard. In an account lifecycle automation skill, this inconsistency can lead to accidental or scripted destructive actions without an operator checkpoint.

Context-Inappropriate Capability

High

Confidence: 95% confidence
Finding: The script persists subscription URLs, UUIDs, email addresses, and other account metadata into markdown log files on disk. Subscription URLs can function like bearer secrets for VPN/profile access, so storing them in plaintext expands exposure to anyone with filesystem or backup access and creates durable credential leakage risk.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The script is presented as a squad lookup tool but also prints the user's UUID and subscription URL, which are additional sensitive identifiers not necessary for the stated task. This increases unnecessary data exposure to anyone with terminal access, logs, shell history capture, or automation consuming the output.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The HTTPS client allows TLS certificate verification to be disabled via config.sslRejectUnauthorized !== false. If this setting is false, the script will accept invalid certificates and send a bearer token plus account-search traffic to a potentially spoofed endpoint, enabling man-in-the-middle interception and response tampering.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The document exposes real user email addresses and direct subscription URLs, and it instructs operators to manually share them. Those URLs appear to function as bearer-style access links, so anyone who obtains them may access or misuse the associated subscription resources without additional authentication. The lack of privacy warnings, masking, expiration, or secure delivery guidance increases the likelihood of accidental disclosure.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The script collects the SMTP password and persists it to disk in smtp.json without clearly warning the user that the credential will be stored locally. Although it sets file mode 0600, local secret persistence increases exposure through backups, accidental commits, endpoint compromise, or other local-user/process access.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The API token is written into a .env file without an explicit disclosure that the secret will be persisted. Storing API tokens on disk can lead to leakage via source control, backups, log/diagnostic collection, or compromise of the local environment, especially because the target path is a parent-directory .env that may be shared by other project components.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The template sends sensitive VPN access information, including a subscription URL and account identifier, directly by email but does not warn recipients to protect the message, avoid forwarding it, or treat the links as credentials. If the email is misdelivered, forwarded, or accessed from a compromised mailbox, an unauthorized party could use the VPN details to gain network access.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The script loads SMTP configuration, including authentication material, and immediately uses it to send an email to hard-coded external recipients with no operator confirmation, environment gating, or safety checks. In an agent/skill context, this can enable unintended outbound communication, abuse of stored mail credentials, and data leakage if the skill is triggered automatically or by an untrusted workflow.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The report includes full subscription URLs tied to specific user accounts, which appear to function as bearer-style access tokens. Anyone who obtains this document can reuse those links to access or consume the affected users' subscription resources without additional authentication, creating a direct secret leakage rather than a mere documentation issue.

Ssd 3

High

Confidence: 99% confidence
Finding: The document explicitly instructs operators to forward complete account information and full subscription URLs to users, and it includes concrete live examples. This is dangerous because subscription URLs often act as credentials or direct access tokens; embedding and forwarding them in plaintext creates a clear path for unauthorized access through copy/paste mistakes, log exposure, screenshots, or repository leakage. The surrounding context makes this more dangerous because the file is an operational runbook intended for repeated human use, increasing the chance of routine sensitive-data exposure.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.