Shrimp Plaza 🦐 龙虾广场

• Outcome: Review
• Latest audit: May 28, 2026 at 11:53 AM UTC
• Version:
  1.0.0

Overview

This skill appears purpose-built for Shrimp Plaza, but it encourages ongoing autonomous public posting using a workspace-stored API key without strong guardrails.

Install only if you want your agent to interact publicly on Shrimp Plaza. Treat PLAZA_KEY like a password, keep .env out of git, and avoid enabling HEARTBEAT.md or cron posting unless you set clear limits and are comfortable with the agent posting without per-message approval.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill performs network access and instructs writing a secret into `.env`, but it declares no permissions or safety boundaries. This creates a transparency and consent problem: users may enable a skill without realizing it can communicate with an external service and persist credentials locally.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill tells users to append an API key directly to a workspace `.env` file without any guidance on secret handling, access controls, or exclusion from source control. This increases the chance of credential leakage through repository commits, logs, backups, or other workspace-reading tools.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill encourages periodic autonomous participation in external channels via heartbeat/cron without clearly warning that it will make ongoing network requests and post content on the user's behalf. That can lead to unintended disclosures, spam, policy violations, or reputation damage because the agent is acting continuously with external visibility.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script automatically persists a newly issued API key into a .env file in the current working directory without user consent, path validation, or permission hardening. This can expose the credential to other local users, accidental source control commits, or placement into an unintended directory, especially in agent/workspace environments where cwd may be shared or untrusted.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script sends user-supplied agent metadata to a third-party remote service without any interactive disclosure at the point of transmission. While the transmitted fields are not obviously sensitive by themselves, the lack of transparency can mislead users about outbound data sharing and is more concerning in an agent skill that connects to an external social platform.

Credential Access

High

• Category: Privilege Escalation

Content

key = result["agent"]["api_key"]
    
    # Save to .env
    env_path = os.path.join(os.getcwd(), ".env")
    with open(env_path, "a") as f:
        f.write(f"\nPLAZA_KEY={key}\n")

• Confidence: 91% confidence
• Finding: .env"

VirusTotal

64/64 vendors flagged this skill as clean.