Security audit

LUI 定时任务冲突检测

Security checks across malware telemetry and agentic risk

Overview

This skill is a local pre-checker for scheduled task conflicts and does not itself create tasks or send data externally.

Install only if you are comfortable giving the skill structured scheduled-task and shop authorization context for pre-creation checks. Be aware that it writes small local run logs by default; set SCHEDULED_TASK_CONFLICT_CHECKER_TRACKING=0 if you do not want local tracking.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill explicitly instructs the agent to invoke local Python scripts, read reference files, access environment-controlled behavior, and write local tracking logs, yet it declares no permissions. This creates a capability/permission mismatch that can bypass least-privilege controls, reduce auditability, and allow unintended file or shell access if the skill is enabled in a broader runtime than expected.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The module adds telemetry logging to a skill whose stated purpose is task-conflict checking, creating a side-channel for operational data collection unrelated to the core function. Although the payload is described as non-sensitive, emit() accepts and persists arbitrary caller-supplied data to disk without schema or content restrictions, so future callers can easily log sensitive task text, identifiers, or user content.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The docstring claims the tool does not collect sensitive business content, but emit() writes arbitrary payload dictionaries directly to a JSONL file with no validation, filtering, or redaction. This mismatch is dangerous because other parts of the skill can pass raw task descriptions, shop data, order details, or user text into payload, causing silent local data retention contrary to the stated privacy boundary.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The request text '每天9点同步两个店铺库存' is ambiguous because it does not identify which two shops should be targeted, while the proposed task sets all_shops=true. In a scheduling/conflict-checking skill that is supposed to enforce authorization and boundary checks, this ambiguity can cause unintended scope expansion, partial execution against the wrong shops, or incorrect handling of expired authorizations.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The request text at line 5 is broad enough that the skill may trigger on a wide range of natural-language scheduling intents without clear scope boundaries. In a task-creation and conflict-checking skill, overly broad invocation increases the chance of processing unintended requests, which can lead to unauthorized task creation attempts, policy bypass edge cases, or incorrect blocking/merging decisions across shops and permission states.

Vague Triggers

Medium

Confidence: 85% confidence
Finding: The invocation phrase is very broad and can cause the skill to activate outside the intended narrow workflow of confirming LUI/Claw scheduled tasks. In an agent environment, overly broad matching can route unrelated user requests into task-creation logic, increasing the chance of unintended automation decisions or unsafe side effects.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.