Security audit

爱图表3D插图

Security checks across malware telemetry and agentic risk

Overview

This 3D chart skill is not malware, but it needs review because it stores an API key and includes account-backed commands beyond the advertised 3D chart feature.

Install only if you are comfortable giving this skill an aitubiao API key, sending chart data to api.aitubiao.com, and accepting that the bundled CLI contains additional project/PPT/Sankey/export capabilities. Prefer a dedicated or low-quota API key, avoid regulated or confidential datasets unless approved for third-party processing, and delete or rotate the key if you stop using the skill.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The skill instructs the user to paste an API key and then persists it in `~/.aitubiao/credentials` across sessions. Persistent credential collection is sensitive and broader than the immediate task; if the host or adjacent tools are compromised, the stored key could be reused to access the user's account or consume paid quota.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The CLI exposes multiple capabilities beyond the skill's declared purpose of generating 3D chart illustrations, including generic chart creation, PPT generation, Sankey creation, and project export/download. In an agent setting, this scope mismatch increases the attack surface and enables unauthorized use of broader account-backed API functions than the user would reasonably expect from the manifest.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: Allowing PPT project creation is inconsistent with a skill advertised only for 3D chart illustration. Even if the API use is legitimate, this can mislead users and lets an agent spend quota or create artifacts outside the expected task boundary.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The Sankey creation command broadens the operational scope beyond 3D illustration generation. In agent workflows, unnecessary extra capabilities are risky because they permit unintended actions and quota consumption under the same credentials.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The download/export capability lets the skill save project exports locally, which is materially broader than simple 3D stylization. In an agent environment this can facilitate local file creation and exfiltration of remote project contents to the host filesystem without that capability being clearly disclosed by the skill description.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: Requesting that users paste an API key and storing it persistently without a prominent warning about secret handling, retention, and exposure risk is unsafe. Users may not understand that the credential can outlive the session and may grant ongoing billable access to the external service.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill instructs the agent to read user-supplied files/data and send them to `api.aitubiao.com`, but it does not prominently warn users that local file contents will leave the device and be processed by a third party. This can lead to inadvertent exfiltration of sensitive business data, especially because charts often derive from confidential spreadsheets.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.