Security audit

Catbus-new

Security checks across malware telemetry and agentic risk

Overview

CatBus appears purpose-related, but it asks the agent to run remote install commands, create a persistent network service, and bind the machine to an account with weak confirmation and broad triggers.

Review before installing. Only use this skill if you trust CatBus and want this machine to run a persistent network agent. Inspect the installer first, confirm how to stop the daemon, disable autostart, uninstall, and revoke account binding, and avoid sending sensitive prompts or files through the network until its data handling is clear. VirusTotal was pending and static scan was clean; this Review verdict is based on the skill’s own instructions.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The skill explicitly instructs the agent to extract a shell command from user-provided text and execute it verbatim, which creates an arbitrary command-execution path under the guise of onboarding. Because the command includes a remote script fetch piped to bash, any tampering of the pasted command, relay endpoint, or upstream script can directly compromise the host.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill is presented as a way to access stronger models and remote skills, but its documented behavior includes installing a background daemon, enabling autostart, and binding the host to an external network account. That exceeds user expectations for a simple model-routing skill and increases the risk of unauthorized persistence and ongoing remote connectivity.

Vague Triggers

High

Confidence: 94% confidence
Finding: The trigger phrases are extremely broad and overlap with ordinary requests like web search, paper search, image generation, and 'use a better model,' causing the skill to activate in contexts where the user did not ask to install software or join a P2P network. This raises the chance of socially engineered or accidental execution of risky onboarding behavior on unrelated prompts.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The user-facing confirmation says only that CatBus will be installed to connect to a network, but the underlying flow runs a remote shell script that may modify the system, start a daemon, and create persistence. This is materially misleading because the confirmation omits the most security-sensitive consequences of the action.

Missing User Warnings

High

Confidence: 99% confidence
Finding: In the bindcode path, the skill instructs the agent to run a user-supplied remote install command immediately and suppresses any confirmation, even though the action can install software, start a daemon, configure autostart, and bind the machine to an external account. Eliminating confirmation in a high-impact execution path makes phishing, token confusion, and command injection-style abuse much more dangerous.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.