ShareOne HTML & Document Share Links

• Outcome: Review
• Latest audit: Aug 17, 2026 · 4:37 PM UTC
• Version: 1.2.12

Overview

The skill is mostly a coherent ShareOne publishing integration, but it should be reviewed because it can publish local or conversation content externally and one helper script can print saved API keys in full.

Install only if you want an agent to publish files or conversation-derived content to ShareOne. Before using it, treat every publish/update as external sharing, avoid broad requests like 'share the last response' unless intended, and do not run check_api_key.js where stdout is logged unless the key-printing behavior is fixed or the key is rotated afterward.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (21)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence
• Finding: The skill directs the agent to use shell commands, environment-stored credentials, and network access to perform publishing and account actions, but it does not declare those capabilities or corresponding permissions. That creates a transparency and policy-enforcement gap: users and hosting platforms may not realize the skill can access tokens, call remote APIs, and invoke local scripts that affect external state.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The declared description focuses on hosting and sharing documents, but the instructions authorize a much broader administrative surface: creating/deleting API keys, binding accounts, managing collaborators, deleting shares, replying to comments, and refreshing remote content. This mismatch can mislead users and enforcement systems about the real power of the skill, increasing the chance of unexpected destructive or account-affecting actions.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The script prints the resolved API key directly to stdout in both fallback and direct modes, which exposes a secret to terminal history, logs, CI output, or any parent process capturing stdout. Since this script only needs to indicate presence/validity of a key, echoing the full credential is unnecessary and creates a clear secret-disclosure risk.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: This script can post agent replies and change comment status to resolved or dismissed, which are moderation/workflow actions not clearly covered by the stated skill scope of publishing pages/docs and sharing links. Even without code injection or auth bypass in this file, bundling hidden moderation capability into a publishing-oriented skill expands authority in a way that can be misused to suppress feedback, falsify issue resolution, or manipulate audit trails if an agent or user invokes it unexpectedly.

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: The trigger examples are broad enough that generic requests like 'share this', 'give me a link', or references to prior conversation content may cause the skill to activate and publish material externally when the user may not have intended a public upload. In this context, unintended invocation is particularly risky because the skill can create persistent public links and operate on existing shares.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The skill enables implicit invocation with no trigger phrases or approval constraints, which can cause the agent to invoke ShareOne during ordinary conversation and publish or update user files without sufficiently explicit intent. In this skill’s context, the action is especially sensitive because it can expose local documents or modify existing shared links, creating data leakage and unauthorized publication risk.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill description and default prompt describe publishing and updating content but do not warn users that local files may be uploaded and exposed via share links. This weakens informed consent and increases the chance that a user or calling agent triggers publication of sensitive documents without recognizing the security and privacy implications.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The code outputs full API key values without masking or warning, making accidental disclosure very likely in normal operation. In an agent skill context, stdout is often surfaced to users, orchestration layers, telemetry, or debug logs, so the secret can be broadly exposed beyond the local shell.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: Accepting an API key via a command-line argument can expose the secret through shell history, process listings, audit logs, and orchestration tooling. In agent or multi-user environments, this can lead to credential theft and unauthorized access to private shares or broader ShareOne API operations.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The script explicitly accepts secrets via command-line flags such as --api-key and --password. On multi-user systems or in CI environments, command-line arguments can be exposed through process listings, shell history, job logs, or telemetry, which can leak credentials used to publish or protect ShareOne content. In this skill context, the risk is elevated because the tool handles publishing and share-protection settings, so leaked values could expose unpublished documents or allow unauthorized modifications.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: When proxy-backed credential storage fails, the code silently falls back to local storage of the API key with force enabled. Storing a sensitive credential on disk without explicit user consent or a clear warning increases the risk of credential disclosure through local compromise, backups, logs, or other processes that can read the fallback store.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: In the non-proxy path, the script writes the API key to local storage by default and only reports success afterward, without prior disclosure that a sensitive credential is being persisted. This can surprise users and exposes the key to theft if the local machine, home directory, or stored config is accessible to other users, malware, or backup systems.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger phrases are broad enough to match common, unrelated user intents such as general registration or email-binding questions, which can cause the agent to invoke an account-binding workflow unexpectedly. In this skill, unintended activation is more dangerous because the workflow can send verification emails and alter account state, creating confusion, privacy issues, and potential abuse of rate-limited backend actions.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The workflow explicitly instructs the agent to update existing published content without showing a safety prompt or obtaining fresh user confirmation. In a comment-processing context, this weakens an important authorization and intent-verification boundary: an agent could apply destructive, misleading, or attacker-influenced edits to a live page based only on comments or ambiguous instructions, with no final human checkpoint.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The workflow instructs the owner's agent to create a guest API key and send it to another person, but it does not explicitly warn that the returned key is a sensitive credential that grants account access and must be transmitted and stored securely. In a collaboration workflow, this is especially dangerous because the step normalizes credential handoff and could lead to leakage through chat logs, insecure channels, or accidental reuse without the recipient understanding the security implications.

Missing User Warnings

High

• Confidence: 90% confidence
• Finding: The workflow explicitly tells the agent to create a new share link without showing a safety prompt or waiting for confirmation. Because publishing sends the document to an external service and may expose sensitive content, suppressing confirmation increases the chance of accidental disclosure when the user’s intent is ambiguous or the selected file is inferred from context rather than explicitly named.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The workflow explicitly tells the agent to create a new share after only an internal self-check and to avoid showing any warning or asking the user for confirmation before a first-time POST. For a publishing/sharing skill, suppressing an explicit confirmation step increases the risk of accidental disclosure of sensitive, proprietary, or regulated content because the action makes content externally accessible.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The workflow instructs the agent to use owner-only credentials and perform a remote refresh, but it does not require any user confirmation, authorization check, or warning that the action causes an authenticated fetch against the bound remote source. In an agent setting, this can enable unintended privileged actions or SSRF-like access to protected upstream content through the service owner's trust boundary.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: This workflow enables changing sensitive sharing controls such as access passwords, comments, and data-storage settings without requiring any explicit user confirmation or warning about the security and privacy consequences. An agent following this workflow could weaken protections, expose shared content more broadly than intended, or enable retention/features with privacy implications based on an ambiguous or casually phrased request.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The skill explicitly allows publishing the current conversation history to a persistent public ShareOne link. Conversations often contain secrets, personal data, internal code, or operational details, so making that content public can cause immediate confidentiality breaches and durable data exposure.

Ssd 3

Medium

• Confidence: 93% confidence
• Finding: Examples such as sharing the previous conversation or last response normalize uploading model outputs and chat history to a public link. Even when framed as examples, they increase the chance of accidental disclosure of sensitive generated content, private prompts, or embedded credentials from prior turns.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.insecure_tls_verification (+1 more)

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/proxy_support.test.cjs:9

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/publish.js:118

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/proxy_support.test.cjs:49

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/proxy_support.test.cjs:52

Instructions pass high-value credentials through process argv.

Critical

• Code: suspicious.secret_argv_exposure
• Location: workflows/download-file.md:33

Instructions pass high-value credentials through process argv.

Critical

• Code: suspicious.secret_argv_exposure
• Location: workflows/publish-binary-file.md:33

Instructions pass high-value credentials through process argv.

Critical

• Code: suspicious.secret_argv_exposure
• Location: workflows/publish-text-page.md:49

Instructions pass high-value credentials through process argv.

Critical

• Code: suspicious.secret_argv_exposure
• Location: workflows/update-share-settings.md:32