变更方案自动审核助手

• Outcome: Review
• Latest audit: Jun 24, 2026 · 6:00 AM UTC
• Version: 3.3.1

Overview

This skill is a document-review tool, but it persistently stores raw deployment documents and derived findings without retention limits or clear user controls.

Review this carefully before installing. Use it only in an environment where storing copies of deployment plans, spreadsheets, reports, and issue evidence under the skill directory is acceptable. Avoid submitting files with live credentials unless you are prepared to manually purge the raw archive, output files, and tracking workbook afterward.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill includes explicit file-write behaviors such as copying uploaded documents into a raw archive and saving generated reports under the skill directory, but no declared permissions are present to signal that persistent storage will occur. This creates a transparency and governance gap: users and the platform may not expect durable local writes of potentially sensitive deployment materials.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented behavior materially diverges from the declared purpose: it archives raw inputs, handles additional management spreadsheets, writes tracking artifacts, and the static finding indicates the implementation may not actually use the stated template-selection process. Security-relevant behavior mismatches are dangerous because they undermine informed consent, make auditing harder, and can conceal unexpected data handling or decision logic from users.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The script silently copies all user-supplied source documents into a persistent raw archive directory before processing. Because the inputs are deployment plans and spreadsheets that may contain passwords, IPs, hostnames, and operational details, this creates unnecessary retention of sensitive material and expands the exposure window if the host or workspace is later accessed by others.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: Persistent retention of full source documents is not necessary to perform the immediate review and is not clearly justified by the skill’s declared purpose. Keeping raw originals increases data-at-rest risk, especially because this reviewer explicitly scans for plaintext passwords and therefore is likely to ingest highly sensitive content.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill mandates copying all uploaded source documents into a persistent raw archive before processing, but does not provide a clear user-facing warning or consent flow for retention. Because deployment plans and spreadsheets can contain infrastructure topology, hostnames, IPs, credentials, and operational details, silent retention substantially increases confidentiality and compliance risk.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill requires saving generated reports and tracking artifacts to disk without clearly warning users that outputs will persist locally. Even derived reports can reproduce sensitive operational details from the source materials, so silent persistence expands the attack surface and data-retention footprint beyond the immediate task.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The tool archives input files without any user-facing warning or consent at invocation time, creating a covert data-retention behavior. Undisclosed persistence is dangerous because users may supply confidential documents assuming they are only analyzed transiently, not stored for later access.

Ssd 3

Medium

• Confidence: 98% confidence
• Finding: The skill explicitly requires persistent archival of all user-provided input files under a raw data directory before any processing. In this context, the files are deployment plans and infrastructure spreadsheets that may include highly sensitive operational and credential-adjacent data, so creating a historical raw-data store materially raises breach impact if the host or skill workspace is accessed.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The skill directs that all process artifacts, including raw uploads and historical tracking files, be retained under the skill directory as an ongoing repository. Long-lived accumulation of sensitive documents and derived findings increases the likelihood and blast radius of unauthorized disclosure, especially because change-review materials often reveal internal architecture and deployment procedures.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The raw archival feature stores complete user-provided documents in plain form under a persistent directory, and those documents may include infrastructure topology, management IPs, hostnames, and even plaintext credentials that the tool is designed to detect. This materially increases the blast radius of any local compromise, backup exposure, or accidental sharing of the skill directory.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The generated tracking spreadsheets include evidence snippets copied from the source documents, and those snippets can reproduce secrets or sensitive operational data such as plaintext passwords, connection strings, and internal IP information. This propagates sensitive content into additional files, increasing the number of places where confidential data is stored and potentially shared.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.