Security audit

local-business-live-cycle

Security checks across malware telemetry and agentic risk

Overview

The skill is a real local-business marketing assistant, but it needs Review because it mixes diagnosis with off-platform lead capture, local report generation, and some privacy and consumer-disclosure risks.

Install only if you are comfortable with a marketing-focused skill that may direct users to Notion/WeChat, generate local report files, and use hosted HTML/CDN assets. Treat any merchant or customer data as sensitive, get consent before saving or collecting contact details, and do not follow guidance that conceals material product facts such as near-expiry food status.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The skill claims diagnostic data stays local, but later instructs users to use external Notion pages and hosted web tools. This creates a misleading privacy representation that can cause users to disclose business or operational data under false assumptions, resulting in unintended third-party exposure.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The manual instructs the agent to write HTML reports directly to the user's desktop and convert them to PDF via Chrome headless. That moves the skill from advisory behavior into filesystem manipulation and local tool orchestration, creating unnecessary capability expansion and potential for unauthorized file creation or abuse if the content or filenames are influenced by user input.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The manual directs use of Chrome headless and references a CDN-hosted diagnostic page. Pulling remote content and rendering it locally introduces supply-chain and integrity risk: external content can change without review, and headless browser execution broadens the attack surface beyond the skill's stated advisory purpose.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The publish log explicitly documents a redesign of the skill into a lead-generation funnel that pushes users toward adding WeChat and purchasing paid services, which exceeds the stated scope of a store-diagnosis/content-generation assistant. This creates a deceptive scope mismatch: users invoke an operational assistant, but the underlying design intentionally steers them into off-platform contact and monetization flows.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: This finding is a true issue because the document explicitly proposes adding a diagnostic report containing a WeChat QR code and follow-up timing, turning an ostensibly operational assistant into a private-channel lead capture mechanism. That creates a mismatch between the skill's stated purpose and its actual conversion workflow, which can mislead users into sharing business data under the impression they are only receiving operational help.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: This is a true vulnerability because the file describes a post-report CTA strategy that diverts users to WeChat at the moment of peak trust and anxiety, while that conversion behavior is not reflected in the declared skill description. In the context of a business advisory skill, this is dangerous because it combines persuasive profiling, opaque marketing intent, and off-platform migration where platform safeguards, auditing, and consent controls may no longer apply.

Context-Inappropriate Capability

Low

Confidence: 91% confidence
Finding: The template pulls Chart.js from a third-party CDN at render time, which creates a supply-chain and privacy risk for a report that could otherwise be fully local. If the CDN is compromised, blocked, or observed by an attacker, generated reports may execute untrusted code or leak client metadata when opened.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The file explicitly instructs the operator to save chat records to a case file, but it provides no guidance on minimizing, redacting, obtaining consent for, or securely storing merchant information. Because the worksheet collects business performance, pricing, operational constraints, and personal willingness to appear on camera, this can lead to unnecessary retention and exposure of sensitive commercial or personal data.

Vague Triggers

Medium

Confidence: 85% confidence
Finding: The trigger phrases are broad everyday expressions such as '复盘' and '数据', which can cause accidental activation outside the intended context. Unintended routing into this skill may expose prior conversation content, business details, or cause the assistant to follow the wrong operational workflow without clear user intent.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The document includes recursive deletion commands (`rm -rf`) against a temporary path as part of publishing instructions, but provides no cautionary note or safeguards. Even though the path shown is illustrative, users commonly adapt and copy shell snippets, and a small path-editing mistake could lead to unintended deletion of local files.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The document explicitly proposes public hosting of a single-file diagnostic tool and mentions collecting contact information, but it provides no user-facing privacy notice, consent flow, retention policy, or clarification of what data is stored locally versus shared. In this business-lead-generation context, users may reasonably enter identifiable business or personal contact data, creating privacy and compliance risk if the tool is later modified, embedded, or served from third-party infrastructure without transparent disclosure.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The fallback trigger includes very common user expressions like “不会用 / 卡住了”, which can be said in many unrelated contexts and may unintentionally switch behavior or invoke fallback logic. In a skill-driven agent, overly broad triggers increase the chance of accidental activation, prompt-flow hijacking, or confusing mode changes that interfere with normal operation.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The workflow explicitly instructs staff to collect customers' WeChat contacts as part of redemption without any notice, consent language, purpose limitation, or handling guidance. In a business-operations skill, this normalizes informal personal data collection and can lead to privacy violations, regulatory exposure, and misuse of customer contact information.

Natural-Language Policy Violations

High

Confidence: 98% confidence
Finding: The guidance says not to mention that the yogurt is near expiry and instead frame the promotion around a celebratory story. In a local retail skill handling food sales, omitting a material product fact can mislead consumers, undermine informed consent, and create legal and trust risks—especially for perishable goods with limited remaining shelf life.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.