Security audit

Skill

Security checks across malware telemetry and agentic risk

Overview

The skill mostly behaves like a disclosed hosted link summarizer, but its install metadata advertises unrelated high-impact crypto and purchase capabilities and it can implicitly send pasted links to a hosted service.

Install only if you are comfortable sending pasted Douyin or Xiaohongshu links to linktranscriber.store. Do not grant or rely on any crypto or purchase-related authority for this skill unless the publisher explains and corrects that mismatch. Avoid private, tokenized, or sensitive URLs, and review any backend-provided comment suggestions before using them publicly.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill instructs the agent to use environment-controlled configuration and make outbound network requests, but it does not declare corresponding permissions. That creates a transparency and policy-enforcement gap: operators may approve the skill believing it is low-privilege while it can still access env-based overrides and contact remote services, including alternate endpoints via LINK_SKILL_API_BASE_URL.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 85% confidence
Finding: The documented purpose says the skill summarizes links, but the spec also allows additional behaviors such as returning backend-provided comment candidates, health-check functionality, and install/update flows. This mismatch increases the chance that reviewers and users underestimate what the skill can do, which is risky because hidden or under-documented behaviors can expose data to extra endpoints or enable unintended operational actions.

Context-Inappropriate Capability

Low

Confidence: 93% confidence
Finding: The deployment guide exposes specific internal workstation paths and workspace references that are not necessary for external users to deploy the skill. Even without credentials, these paths disclose internal usernames, repository layout, and organizational structure, which can aid reconnaissance or social engineering against the maintainer environment.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The file explicitly states that user-provided links are sent to a publisher-operated hosted service, but it does not document any user-facing notice about what data is transmitted, retained, or logged. This creates a real privacy and informed-consent gap, especially because social-media links can embed identifiers or point to personal content, and users may not realize their input leaves the local skill context.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The skill enables implicit invocation (`allow_implicit_invocation: true`) without any narrowly defined trigger conditions or clear user-consent boundaries. Because the default prompt also says to execute immediately when a supported link is present, the agent may call the hosted service and send user-provided links off-platform without an explicit confirmation step, increasing the risk of unintended data disclosure or surprise external actions.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The script sends a user-supplied Douyin/Xiaohongshu link to a third-party hosted service (`linktranscriber.store`) without any explicit consent prompt, privacy notice, or clear disclosure at the point of transmission. Even if this is core to the skill's function, links may embed personal identifiers, private tokens, or sensitive shared content, so silent exfiltration to an external service creates a real privacy and data-handling risk.

VirusTotal

60/60 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.