Security audit

Moa Publish

Security checks across malware telemetry and agentic risk

Overview

This skill does what it says: it sends user questions to configured external LLM providers for parallel advice, with disclosed but privacy-sensitive persistent and diagnostic modes.

Install only if you are comfortable sending MoA prompts to the configured third-party model providers. Do not use persistent mode with sensitive chats unless you intend every later message to be processed through those providers, and treat /moa doctor output as local diagnostic information.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill invokes Node.js, reads environment variables for many provider API keys, and performs outbound calls, yet it declares no permissions. This creates a transparency and policy-enforcement gap: a host or reviewer may underestimate the skill's ability to access secrets and transmit user data to external services.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The advertised behavior is narrower than the documented operational behavior: the skill also performs health checks, local file reads, and model override resolution driven by environment and input. That mismatch can mislead users and operators about data flows and capabilities, increasing the chance of unsafe deployment or unintended external transmission.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The health-check path enumerates whether provider API keys are present, exposes their lengths, and actively probes multiple third-party endpoints. Even if intended for diagnostics, this expands the skill's capability beyond core MoA execution and can disclose sensitive environment posture or be abused for network reconnaissance from the host environment.

Description-Behavior Mismatch

Medium

Confidence: 98% confidence
Finding: The file claims API keys are read from environment variables, but the Google provider code later fails to actually attach the Gemini key to requests and instead constructs a malformed placeholder query string. This discrepancy can break authentication logic, cause unexpected failures, and encourage unsafe debugging or compensating workarounds around credential handling.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The module documentation says provider credentials are sourced from environment variables, but Google requests discard the retrieved key and replace it with an invalid placeholder in the URL. That is a credential-handling flaw that undermines expected security controls and may produce misleading operational behavior around external API access.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The README explicitly states that multiple external model providers receive conversation text in parallel, but it does not clearly warn users that their prompts and potentially sensitive conversation data will be transmitted to third-party services. In a skill that can be applied to arbitrary user questions and may be used in operational environments, this omission creates a real confidentiality and privacy risk because users may unknowingly expose secrets, internal data, or regulated information to several providers at once.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: Persistent mode causes every subsequent user message to be sent through a multi-model pipeline automatically, which can forward sensitive prompts to multiple external providers without per-message confirmation. In context, this is more dangerous because the skill is explicitly designed to fan out data across several third-party APIs, magnifying privacy and data-governance risk.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: The health and status commands disclose whether specific provider API keys are configured and whether endpoints are reachable. While not exposing the keys themselves, this reveals sensitive environment metadata and provider inventory that can aid reconnaissance or leak operational details to an untrusted user.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: This executor sends the full user conversation, plus system advisory prompt, to multiple external model providers in parallel. In an MoA skill this is core functionality, but without explicit user consent, provider restrictions, or redaction controls, sensitive data may be unnecessarily replicated across several third parties, increasing confidentiality and compliance risk.

Ssd 3

Medium

Confidence: 93% confidence
Finding: The skill instructs the system to inject reference model outputs verbatim into the response context and potentially show them back to the user alongside the original question. In this MoA setting, that can leak sensitive user content, confidential reference responses, or prompt-injected material from external models, and it increases cross-model prompt-injection risk by treating untrusted outputs as trusted context.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.