Security audit

技能自动发布器

Security checks across malware telemetry and agentic risk

Overview

This skill automates publishing and marketplace tasks, but it exposes reusable credentials and handles account tokens in ways users should not accept without review.

Do not install this version as-is. Treat the included GitHub and BotStreet credentials as compromised, rotate them, remove all bundled secrets, replace automated password and token scraping with user-driven scoped authentication, and add explicit confirmation plus enforced approval before any publish, task application, or delivery submission.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (19)

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The skill explicitly instructs the agent to use stored GitHub credentials, read a secret file, complete login, extract an authentication token from the page, and persist that token for later use. This goes beyond ordinary skill packaging and creates a credential-handling and account-access capability that could be abused for unauthorized access, account takeover, or exfiltration of reusable secrets.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The document labels the web upload path as manual, but surrounding sections normalize automated credential use and login completion, making it likely that an agent or user would treat the 'manual' path as safe while still relying on hidden automation. This mismatch increases the chance of unsafe authentication behavior and reduces informed consent around account access.

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: The document asserts that every operation must pass a strict review gate, but the skill only describes review as narrative guidance and still exposes direct task application and delivery actions through APIs and CLI commands without any technical enforcement. This creates a misleading safety model: an agent or integrator can perform externally visible actions immediately, defeating the claimed control and enabling unsafe or noncompliant submissions.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The skill explicitly instructs the agent to remove or avoid any indication that content was AI-generated, making concealment of authorship a required part of operation. In the context of a task marketplace and promotional content production, this is dangerous because it facilitates deceptive submissions, evasion of platform disclosure rules, and misrepresentation of how content was produced.

Intent-Code Divergence

Medium

Confidence: 87% confidence
Finding: The skill claims that all operations require review, but capabilities such as notification retrieval, account inspection, and earnings queries are presented without corresponding review stages or access constraints. This inconsistency weakens operator trust, encourages overbroad automation, and can lead to unnecessary exposure of account data or action beyond intended governance boundaries.

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: The file embeds a live-looking agent ID and agent key directly in source code while claiming they come from SECRET.md. Hardcoded credentials in a distributed script can be extracted by anyone with file access and used to impersonate the agent against the BotStreet API, causing unauthorized task actions and account abuse.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: Several trigger phrases are broad everyday publishing terms such as '发布技能' and '上传新技能', which can be mentioned in normal conversation and accidentally activate this workflow. Because the workflow includes sensitive publishing and authentication-adjacent actions, ambiguous triggers materially raise the risk of unintended execution.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: The trigger list and step-specific trigger names do not align, so the activation boundary is unclear. Unclear activation rules are dangerous in agent skills because they can cause over-broad matching, accidental invocation, or execution of higher-risk actions outside the user's intended scope.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The skill directs automatic filling and use of GitHub credentials without any meaningful warning about account security, consent, reuse risk, or the sensitivity of secret material. In context, this is especially dangerous because the skill is about uploading marketplace content, not secret management, so automating credential use is unnecessary and expands risk substantially.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The instructions to read page text, extract a token, and save it create an exfiltration and persistence path for reusable authentication material. Tokens are often sufficient for API access without re-entering credentials, so exposing them in agent-readable output or storing them insecurely can lead to account compromise and lateral misuse.

Natural-Language Policy Violations

High

Confidence: 99% confidence
Finding: These instructions directly require concealing AI involvement in generated content, which is a deceptive-content pattern rather than a neutral quality-control measure. In a marketplace skill designed to create and submit content for compensation, this materially increases the risk of fraud, policy evasion, and reputational or contractual harm to users and platforms.

Missing User Warnings

High

Confidence: 100% confidence
Finding: The skill file contains what appears to be live authentication material: a specific agent ID and agent key embedded directly in documentation. Exposed credentials can be harvested and abused to access the BotStreet account, read notifications, inspect account data, apply for tasks, submit deliverables, and potentially incur fraud or account takeover.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The documentation instructs users to send an `x-agent-key` private credential on every request but does not warn that it is a secret that must never be embedded in client-side code, logs, screenshots, or public posts. In an agent-skill context, documentation often gets copied directly into implementations, so omission of credential-handling guidance increases the chance of accidental secret exposure and subsequent unauthorized API access.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The script silently uses hardcoded API credentials as defaults, so a user may unknowingly operate using someone else's privileged account context. This creates both credential exposure and confused-deputy risk: anyone running the script can perform authenticated API calls without understanding they are leveraging embedded secrets.

Missing User Warnings

Low

Confidence: 92% confidence
Finding: This product explicitly generates promotional content for publication, yet it does not warn users to manually verify factual claims, endorsements, or compliance with platform advertising and content rules before posting. That omission can lead users to publish misleading, non-compliant, or inadequately substantiated marketing content, increasing legal, platform-enforcement, and reputational risk.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The script deletes the destination directory with shutil.rmtree(dest_dir) automatically if it already exists, without prompting the user or performing strong safety checks on the resolved path. If the output directory or skill name is mis-specified, this can cause unintended data loss by recursively deleting existing files or folders on the local filesystem.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The document instructs the operator to obtain GitHub authorization and upload packaged skills to a third-party platform, but it does not include meaningful consent, risk disclosure, or guardrails around account use and external publication. In an agent-skill context, that omission is dangerous because it can normalize account-linked actions and publishing behavior without clearly warning about credential scope, ownership approval, reputational impact, or accidental disclosure of packaged content.

Ssd 3

High

Confidence: 99% confidence
Finding: This section explicitly instructs the agent to read stored credentials from another file, perform automated authentication, and reproduce an authentication token from page content. In the context of an agent skill, that is a direct secret-access and token-handling capability that could be repurposed for unauthorized account access or credential theft.

Ssd 4

High

Confidence: 98% confidence
Finding: Taken together, the review process is not a safety control but a workflow for producing, validating, and submitting promotional content while specifically concealing AI authorship. The surrounding context—a task-taking agent for paid content and social promotion—makes this more dangerous because it operationalizes deceptive commercial content generation at scale rather than merely describing generic writing assistance.

VirusTotal

No VirusTotal findings

View on VirusTotal

Static analysis

No suspicious patterns detected.