宏观经济数据

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:29 PM UTC
• Version:
  1.0.6

Overview

This is a read-only macroeconomic data query skill, with the main caveat that it sends queries to a hardcoded private HTTP server.

Install only if you intentionally use a macro-data FastAPI service at 10.168.1.162:8000. Be aware that query names, dates, and parameters travel over unencrypted HTTP on that network, and you may need to install the Python requests package separately.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script sends user-supplied query parameters and date values over plain HTTP to an internal IP address, so request data can be observed or modified by anyone with network visibility on the path. Because the tool is specifically designed to transmit potentially sensitive macro query inputs and gives no warning that the connection is unencrypted, this is a real confidentiality and integrity risk rather than a cosmetic issue.

VirusTotal

65/65 vendors flagged this skill as clean.