Security audit

鸿蒙开发决策助手

Security checks across malware telemetry and agentic risk

Overview

The skill mostly matches its stated purpose, but the HTML report it generates can run unsafe injected content from report inputs.

Install only if you are comfortable reviewing generated HTML before opening or sharing it, especially when report data comes from web results or other untrusted text. Prefer a fixed invocation phrase and ask the publisher to HTML-escape report fields before using this in shared or browser-previewed workflows.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The report template injects user-controlled fields such as product name and direction directly into HTML without escaping. If any upstream caller passes HTML or JavaScript payloads, the generated report becomes an XSS-capable document that will execute in the viewer's browser or webview, which exceeds the skill's stated purpose of producing a passive decision report.

Context-Inappropriate Capability

Medium

Confidence: 99% confidence
Finding: Many structured fields from JSON inputs are inserted raw throughout the body, including paragraphs, table cells, tags, and repeated list items. This allows arbitrary markup injection and likely stored/self-XSS in generated HTML reports; in environments where reports are previewed in a browser, embedded webview, or shared internally, an attacker can run script, exfiltrate local/session data, or spoof report content.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The trigger phrases are broad and semantically overlap with ordinary user requests about whether to build a HarmonyOS app. This can cause the skill to activate unintentionally in contexts where the user did not explicitly intend to invoke it, leading to unexpected behavior, context hijacking, or incorrect routing away from safer/default handling.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The usage examples demonstrate activation through broad natural-language requests instead of a clearly delimited invocation format. This encourages ambiguous matching, making it more likely that normal conversation about HarmonyOS product planning will accidentally trigger the skill and inject its workflow or generated HTML output into unrelated sessions.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The example triggers include broad natural-language phrases such as '帮我评估做鸿蒙版AI写作工具可行吗' and '分析鸿蒙原生社交APP的可行性', which can overlap with ordinary conversation and cause accidental invocation. Mis-triggering is not a direct code-execution issue, but it can cause unintended web searches, report generation, and file output, increasing privacy and operational risk.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.