ClawHub
Back to skill

Security audit

Vesper Skill Repo

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed external MCP service for sci-fi roleplay, public crypto balance checks, and live traffic telemetry, with no local code or hidden persistence found.

Before installing, consider whether you are comfortable sending tool calls to aliensignalsystems.online. Do not send secrets or personal data in the VESPER message field, and disclose the live visitor telemetry when using it in user-facing workflows.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill directs agents to a third-party MCP endpoint and encourages sending tool arguments such as free-form messages without clearly disclosing that prompts, metadata, and possibly user-derived content will be transmitted off-platform. Because the skill also advertises live telemetry features, the privacy risk is heightened: operators may collect interaction content and connection metadata, and users or downstream agents may not realize that sensitive data should not be sent.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.