Security audit

Event Countdown Pro

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed stock-event reminder skill with a small Yahoo Finance helper script and no evidence of hidden data access, theft, or destructive behavior.

Before installing, understand that this can create automated daily stock-event messages in the chat where you use it. Confirm the event date, reminder start timing, timezone, and delivery chat before approving the cron, and cancel the reminder when you no longer want the briefings.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill instructs the agent to auto-detect channel and chatId from session context and use them to create reminders without explicit user confirmation or a privacy notice. This can lead to reminders being created in an unintended destination or use of messaging metadata in a way the user did not knowingly authorize, especially in multi-channel or shared-context environments.

Natural-Language Policy Violations

Medium

Confidence: 84% confidence
Finding: Applying a default timezone such as Europe/Paris without explicit user opt-in can cause reminders to fire at the wrong local time, leading to unintended actions and possible information disclosure to a user at an unexpected hour. In an automated reminder skill, silent timezone assumptions increase the chance of misdelivery and user confusion.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.