Security audit

文件快速扫描 - 减少token消耗

Security checks across malware telemetry and agentic risk

Overview

This is a local file-indexing skill with some privacy-sensitive but optional scanning features; no deception, exfiltration, or destructive behavior is shown.

Install only if you want a local project indexer. Run it on intended folders, add excludes for secrets or private notes, review generated .anatomy.md files before sharing them with an agent, and use --scan-downloads only when you explicitly want recent Downloads filenames included.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill documentation instructs users to run Python scripts that read project files, write output to `.anatomy.md`, and invoke shell commands, but the skill declares no permissions. This creates a transparency and policy gap: a user or agent may treat the skill as lower risk than it is, while it actually has broad filesystem and command-execution capabilities.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documented purpose is project anatomy/indexing, but the static finding indicates additional hidden behavior for reimbursement analysis, scanning `~/Downloads`, and extracting financial metadata from user files. That is materially outside the declared scope and would expose unrelated personal documents and sensitive financial information without informed consent.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The script's documented purpose and the skill manifest describe lightweight project/file anatomy scanning, but the implementation is a specialized expense reimbursement analyzer that extracts structured business data from filenames and produces workflow-specific summaries. This is a scope mismatch that can mislead users into granting trust or access under false expectations, increasing the chance that sensitive financial/receipt metadata is processed without informed consent.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The optional Downloads scan expands access beyond the user-supplied expense directory into ~/Downloads, a separate and commonly sensitive location containing unrelated personal files. Even though it is flag-gated, this behavior exceeds the advertised scope of project/file scanning and can enumerate recent documents and images, exposing filenames, timestamps, and sizes from unrelated user activity.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The command-line option exposes a capability to inspect recent PDF/JPG/JPEG/PNG files in ~/Downloads that is not necessary for generating anatomy of the target directory. In the context of an agent skill advertised as reducing file reads for project mapping, this hidden lateral visibility is especially risky because users may not expect the tool to inspect personal download artifacts outside the chosen workspace.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The trigger phrase "file index" is broad and plausibly matches ordinary user requests that are not intended to invoke this skill. In a skill that scans projects and summarizes files, accidental activation could cause unnecessary workspace enumeration, increased data exposure to the skill, and user-surprising behavior without clear consent.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The trigger "project map" is ambiguous and can describe many harmless requests, making unintended skill invocation likely. Because this skill is designed to inspect project structure and potentially scan directories like Downloads, accidental activation expands the chance of over-collection or revealing local file metadata beyond what the user expected.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.