it-integration-solution

• Outcome: Review
• Latest audit: Jul 31, 2026 · 8:25 AM UTC
• Version: 1.0.1

Overview

This skill is a document-generation helper for Chinese enterprise IT solution proposals and does not show hidden data access, persistence, or unsafe execution.

Install this only if you want a Chinese enterprise-style IT solution proposal generator. Review or narrow the trigger wording if you often create unrelated technical proposals, and prefer locked dependency installs for reproducibility.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: The skill description hard-codes Chinese-language and China-specific enterprise formatting expectations without making them conditional on user preference. This can cause the agent to override user intent, produce jurisdiction-specific content in the wrong context, or leak organizational assumptions into outputs, which is a prompt-scope and policy-quality issue even if not a code-execution risk.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The invocation phrases are broad enough to match many generic requests such as creating a technical proposal or solution document, which can cause unintended skill activation. Over-broad triggering can hijack unrelated document-generation tasks, leading to incorrect outputs, unwanted formatting constraints, and reduced user control over agent behavior.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"license": "ISC",
  "description": "",
  "dependencies": {
    "docx": "^9.7.1"
  }
}

• Confidence: 94% confidence
• Finding: "docx": "^9.7.1"

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.dynamic_code_execution, suspicious.env_credential_access (+2 more)

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: node_modules/@types/node/child_process.d.ts:55

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: node_modules/@types/node/repl.d.ts:30

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: node_modules/@types/node/vm.d.ts:508

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: node_modules/docx/dist/index.cjs:31023

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: node_modules/docx/dist/index.iife.js:31024

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: node_modules/docx/dist/index.mjs:31026

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: node_modules/docx/dist/index.umd.cjs:31026

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: node_modules/jszip/dist/jszip.js:11404

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: node_modules/jszip/dist/jszip.min.js:13

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: node_modules/setimmediate/setImmediate.js:17

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: node_modules/xml-js/dist/xml-js.js:7928

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: node_modules/xml-js/dist/xml-js.min.js:8

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: node_modules/@types/node/http.d.ts:1349

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: node_modules/@types/node/test.d.ts:340

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: node_modules/@types/node/crypto.d.ts:521

Potential obfuscated payload detected.

Warn

• Code: suspicious.obfuscated_code
• Location: node_modules/jszip/dist/jszip.js:1297

Potential obfuscated payload detected.

Warn

• Code: suspicious.obfuscated_code
• Location: node_modules/jszip/lib/utils.js:382