Is burnshall-ui/vpsmon safe?
https://github.com/burnshall-ui/vpsmon
This VPS monitoring skill provides legitimate system monitoring capabilities written in Zig, but contains a concerning prompt injection instruction that attempts to override agent response behavior. The system monitoring and optional Telegram integration functionality appears benign but could be misused for surveillance.
Category Scores
Findings (3)
HIGH Agent Response Override -30 ▶
The skill contains an explicit instruction to override normal agent behavior: 'Respond with only "SYSTEM STATUS" — no summary, no reasoning, no commentary'. This attempts to suppress the agent's normal response patterns and could be used to hide other activities.
MEDIUM System Monitoring with External Communication -20 ▶
The skill provides system monitoring capabilities and includes functionality to send reports via Telegram Bot API. While requiring user configuration, this creates potential for system information to be transmitted externally.
LOW Executable Shell Scripts -5 ▶
The skill includes executable shell scripts (render.sh, send_status.sh.example) that could pose minimal risk if modified or misused, though the current implementation appears legitimate for system monitoring purposes.