Security audit

expert-writing-asmcp

Security checks across malware telemetry and agentic risk

Overview

This AnyShare writing skill is mostly purpose-aligned, but it can continue processing and sharing documents without a clear fresh user confirmation.

Install only if you are comfortable granting AnyShare account access and uploading selected project files to AnyShare. Before using it, remove or ignore the 5-minute auto-proceed rule, require explicit confirmation before body generation and share-link creation, verify link permissions, and avoid running the unsafe Python template-interpolation snippet as written.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The skill states that full-body generation requires explicit user confirmation, but also says it will automatically proceed after 5 minutes of silence. That contradiction can cause unintended write operations on uploaded material and undermines consent boundaries for a workflow that uploads, generates, and persists documents.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: Broad triggers such as '帮我写作' can activate this skill for generic writing requests where users may not expect file upload, external processing, or document-library side effects. In a skill that moves data to AnyShare and generates stored outputs, overbroad activation increases the chance of accidental invocation and unintended data handling.

Missing User Warnings

High

Confidence: 99% confidence
Finding: Automatically generating the full document after 5 minutes of silence is a side-effecting action triggered without fresh consent, despite the workflow involving external content processing and file creation. Because the skill handles uploaded project documents and produces persisted outputs, silent auto-execution can expose sensitive data and create unauthorized artifacts.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The workflow culminates in creation of a share link, but the user-facing flow shown here does not clearly explain the privacy implications of making generated documents accessible via a link. In a document-authoring skill handling project files, omission of that warning can lead to unintended exposure of proprietary or sensitive material.

Ssd 4

Medium

Confidence: 98% confidence
Finding: The workflow explicitly requires confirmation but still advances on user silence, which is an unsafe state transition for an operation that generates and stores content derived from uploaded files. This can cause unauthorized processing and reduce the reliability of user intent validation.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.generated_source_template_injection

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SECURITY.md:37

User-controlled placeholder is embedded directly into generated source code.

Critical

Code: suspicious.generated_source_template_injection
Location: SKILL.md:592