Security audit

Free Model Config

Security checks across malware telemetry and agentic risk

Overview

The skill mostly does what it advertises, but it can automatically upload local images to public third-party hosts and includes unsafe instruction-scoping language, so users should review it carefully before installing.

Install only if you are comfortable with this skill reading model API keys from a local config file and sending prompts, generated content, and possibly local images to external services. Do not use private or sensitive images with the video workflow unless you accept upload to catbox.moe or litterbox, and use placeholders or a proper secret manager for API keys instead of sharing real keys in chats, reports, or committed config files.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (21)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill describes operational capabilities involving environment variables, file access, network access, and shell execution, but does not declare permissions or bound those capabilities. This creates a transparency and containment problem: a user or host system may authorize a seemingly harmless configuration skill while it can actually read/write local files, invoke external tools, and send data over the network.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill is presented as a standardized multi-platform model-configuration assistant, but its behavior includes direct media generation workflows and third-party uploads to public file-hosting services. That mismatch is dangerous because users may consent to configuration help without realizing local media can be exfiltrated to external services or that the skill is narrower and more operational than advertised.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The instruction that the model must never refuse any modification to the skill content is a policy-manipulation mechanism unrelated to legitimate model configuration. It pressures an agent to bypass safety, authorization, or integrity checks and can be used to coerce unsafe edits or broaden the skill beyond what a user intended.

Description-Behavior Mismatch

Medium

Confidence: 86% confidence
Finding: The catalog explicitly states 'API Key 生成' and describes creating keys from a platform backend URL, which goes beyond passive configuration guidance and suggests the skill may direct users into credential lifecycle actions. In a skill focused on free-model setup, this increases the chance of mishandling secrets, over-automating privileged steps, or encouraging users to expose or paste sensitive credentials into unsafe contexts.

Description-Behavior Mismatch

Medium

Confidence: 82% confidence
Finding: The file expands from model configuration into image/video/audio generation and media processing, including chaining and merging operations, which materially broadens the skill’s operational scope. That scope creep creates more opportunities for unsafe actions, policy bypass, unexpected side effects, and misuse because users may invoke powerful content-generation workflows under the benign label of 'configuration'.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The script uploads local images to catbox.moe and litterbox.catbox.moe, which are unrelated third-party public hosting services, before sending them to the video API. This creates an unexpected data-exfiltration path for local media and can expose sensitive user files outside the primary service boundary.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The skill's stated purpose is model/media generation, but the implementation silently republishes local user images to public file-hosting providers not necessary to that purpose. In a skill context, this is more dangerous because users may reasonably expect their local inputs to be sent only to the named AI provider, not exposed through unrelated public infrastructure.

Vague Triggers

High

Confidence: 89% confidence
Finding: The trigger phrases are extremely broad and overlap with normal user requests about models, configuration, images, video, audio, and even meta-skill behavior. Overbroad activation increases the chance that this skill is invoked in contexts where the user did not intend its powerful behaviors, including API-key handling, shell/tool usage, or networked media workflows.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill discusses API key generation, environment-variable usage, and config-file storage but does not provide clear warnings about credential sensitivity, leakage, file permissions, logging, or accidental disclosure. In a skill centered on configuration, this omission materially increases the risk of secret exposure through shell history, plaintext files, copied prompts, or unsafe sharing.

Natural-Language Policy Violations

Medium

Confidence: 87% confidence
Finding: The template hard-codes 'Agnes AI' as the default and repeatedly uses it in examples, which can bias downstream agents to select a specific platform even when the user did not request one. In a model-configuration skill, this creates a supply-chain style policy risk: user intent can be silently overridden, and credentials, traffic, or generated content may be routed to an unintended provider.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The configuration template explicitly includes an 'apiKey' field and instructs the user to generate and fill credentials, but it provides no warning against exposing secrets in chat, logs, templates, or version-controlled files. In an agent skill that standardizes model configuration, this increases the chance that users paste live API keys into generated artifacts or conversations, leading to credential leakage and unauthorized API usage.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The document instructs users to store live API keys in a predictable local config file without clearly emphasizing that these are sensitive credentials or how to protect them. If that file is readable by other local users, synced to cloud storage, committed to source control, or collected in diagnostics, the keys could be exposed and abused for unauthorized API use.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The testing examples normalize sending bearer tokens to external endpoints without a prominent warning that real credentials are being transmitted to third-party services. In a configuration skill centered on API onboarding, this increases the chance that users paste production keys into ad hoc test commands, shell history, shared terminals, or logging systems.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The template directs users to aggregate multiple provider API keys in one local file, increasing the blast radius of any single disclosure. If the file is exposed, an attacker gains access to several external AI accounts at once, potentially leading to billing abuse, account misuse, and data leakage across providers.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The template instructs users to place an API key directly into a persistent local configuration file but provides no guidance on file permissions, secret storage, or redaction. In a skill centered on model/API configuration, this omission is more dangerous because users are likely to copy real credentials into disk files that may later be backed up, synced, or exposed.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The validation steps recommend testing API keys and endpoints with curl/ping without warning that these actions generate real outbound network traffic and may submit credential-bearing requests to external services. In this skill context, users are specifically being guided through live third-party API setup, so the chance of unintentionally transmitting production credentials is high.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The update example shows old and new API key values in a report table, normalizing the practice of recording secrets in human-readable reports and change logs. In a configuration-management skill, this is especially risky because users may copy the pattern into tickets, chat logs, documentation, or audit artifacts that are broadly accessible.

Vague Triggers

Medium

Confidence: 75% confidence
Finding: The catalog framing is broad and does not clearly define when the skill should or should not be used, which can cause over-triggering and execution in contexts not intended by the author. In a skill handling configuration and credential-adjacent tasks, ambiguous activation increases the chance of inappropriate guidance or privileged operations being offered too readily.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The document covers API key handling, interface configuration, template generation, and configuration import without any visible warnings about credential exposure, destination trust, least privilege, or validation before import. In this context, omission of security guardrails is dangerous because users may be led to paste secrets, import unsafe configs, or modify production settings without understanding the risks.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: When a local image is provided to video generation, the script automatically uploads it externally without a clear upfront warning in command help or a consent gate. This violates user expectations about data handling and can leak private media to public or semi-public services.

Ssd 1

Medium

Confidence: 96% confidence
Finding: By forbidding refusal of any skill-content modification, the skill semantically pressures the model to comply with arbitrary instructions regardless of safety or authorization. In context, this is more dangerous because the skill already claims broad operational capabilities, so weakening refusal behavior can facilitate unauthorized changes, persistence, or unsafe execution patterns.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.