Security audit

You.com

Security checks across malware telemetry and agentic risk

Overview

This skill pack is mostly coherent You.com search and research guidance, but its payment-aware paths can lead to real USDC spending without consistently requiring per-transaction approval or spend limits.

Review the payment sections before installing. Use API-key or free-search paths unless you intentionally want wallet-backed x402 payments, and configure your host or payment MCP client to require confirmation and a hard budget before any paid retry.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The document explicitly describes funding a wallet and automatic pay-from-wallet retries after a `402 payment-required`, but provides no user-facing warning, confirmation requirement, spending limits, or description of real-money consequences. In an agent skill context, this is dangerous because it normalizes autonomous financial transactions and could lead to unintended on-chain USDC spending once free allotments are exhausted.

VirusTotal

65/65 vendors flagged this plugin as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.