Security audit

asiasea-bi

Security checks across malware telemetry and agentic risk

Overview

This looks like a real enterprise BI skill, but it needs review because it can store and publish business data together with reusable API authorization headers.

Install only if you are authorized to access these Asiasea/Yayuit/Asagroup systems and can review deployment controls. Before production use, remove auth headers from generated HTML, avoid or secure session-file persistence, require explicit confirmation before uploads/publishing, verify report access controls, and confirm the package provenance.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill advertises networked BI/data-gateway behavior but declares no permissions, which creates a transparency and enforcement gap. In a skill that can query real APIs and publish outputs, undeclared file/network capabilities make it harder for the platform and users to understand the actual trust boundary and increase the chance of covert data access or persistence.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This finding describes materially riskier behavior than the skill's declared BI/query purpose: fetching access tokens, persisting session files, embedding API endpoints and auth headers into generated HTML, and publishing that HTML to externally reachable storage. In the context of a data-gateway skill handling real enterprise systems, these behaviors can expose credentials, leak internal topology, and create long-lived unauthorized access paths.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The generated HTML embeds the live API URL plus authentication headers into client-side JavaScript, only Base64-encoded. Anyone with access to the report, browser dev tools, page source, or the uploaded HTML can recover the token and directly call internal business APIs, potentially expanding access beyond the original user session.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The code comment suggests the token is protected, but Base64 is reversible encoding, not security. This creates a false sense of protection and leaves authentication material plainly recoverable by any recipient of the HTML, increasing the chance of unauthorized reuse and lateral access.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The README instructs users to invoke the skill through broad natural-language triggers such as '初始化', '报表', 'BI', '统计', '趋势', '度量', and '查询' without defining boundaries, confirmation steps, or exclusions. In an agent environment, overly generic triggers increase the chance of unintended activation, ambiguous routing, or accidental execution against sensitive enterprise data systems, especially because the skill is explicitly designed for system switching and live data querying.

Vague Triggers

High

Confidence: 93% confidence
Finding: The trigger set is broad enough to match ordinary BI-related conversation, increasing the chance the skill activates without clear user intent. Because this skill is described as interacting with real business systems, switching domains, querying data, and publishing snapshots, accidental activation could lead to unintended data retrieval or release.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The report silently delivers live API endpoint details and auth headers to the browser without warning or consent. In this BI context, the report is meant for sharing and publishing, which makes credential exposure especially dangerous because the leaked headers can be reused outside the intended interface to fetch sensitive enterprise data.

Missing User Warnings

High

Confidence: 95% confidence
Finding: The skill uploads generated HTML containing business data to a remote OSS/archive service automatically and without explicit user warning or confirmation. Because the HTML may contain both sensitive report contents and embedded API configuration, this transmission increases confidentiality risk and may create durable exposure if the archive is accessible beyond the original user.

Overly Broad Trigger

Low

Category: Trigger Abuse
Confidence: 90% confidence
Finding: The trigger '报表' is too generic and may activate during normal conversation about reports. In a skill capable of querying enterprise data and publishing outputs, such ambiguous activation increases the risk of unintended data operations under the wrong context.

Overly Broad Trigger

Low

Category: Trigger Abuse
Confidence: 92% confidence
Finding: The trigger 'BI' is extremely short and widely used, making accidental activation likely. Given the skill's enterprise data access context, unintended activation can expose sensitive business metrics or switch contexts without the user's deliberate intent.

Overly Broad Trigger

Low

Category: Trigger Abuse
Confidence: 89% confidence
Finding: The trigger '统计' is a common conversational term and is likely to overlap with benign analytics discussion. In this skill's context, that overlap is dangerous because activation may lead to real backend queries rather than a simple conversation response.

Overly Broad Trigger

Low

Category: Trigger Abuse
Confidence: 89% confidence
Finding: The trigger '趋势' is broad and could be matched in many non-invocation contexts. Because the skill claims to derive time semantics and query real APIs, accidental invocation could result in unintended time-scoped data access or analysis.

Overly Broad Trigger

Low

Category: Trigger Abuse
Confidence: 89% confidence
Finding: The trigger '度量' is a generic BI term that can easily appear in ordinary discussion. In a real-data enterprise integration skill, such ambiguity raises the probability of unauthorized or accidental query execution.

Overly Broad Trigger

Low

Category: Trigger Abuse
Confidence: 91% confidence
Finding: The trigger '查询' is one of the broadest possible activators and is likely to collide with routine requests. In this skill, where querying may hit live business APIs, that makes accidental activation materially risky.

Overly Broad Trigger

Low

Category: Trigger Abuse
Confidence: 94% confidence
Finding: The trigger '发布' is especially risky because publication is a side-effecting action that may expose generated reports or snapshots externally. A generic publication trigger in a skill that can create persistent links or snapshots materially increases the chance of accidental data disclosure.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.