Security audit
TurboPush
Security checks across malware telemetry and agentic risk
Overview
TurboPush is a coherent social publishing helper, but it can publish publicly through logged-in accounts without an explicit final confirmation safeguard in the skill instructions.
Install only if you trust the TurboPush application and the turbo-push-mcp binary. Before using it, explicitly require the agent to show the final content, destination accounts, target platforms, and whether it will save a draft or publish publicly before any publish_article, publish_graph_text, or publish_video call.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
64/64 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.