Security audit

Cnsdoce Publish V4

Security checks across malware telemetry and agentic risk

Overview

This skill is mostly a coherent engineering-costing helper, but it needs review because it can send project descriptions to third-party LLM APIs by default and includes a destructive database migration script without confirmation.

Install only if you are comfortable with engineering scope descriptions being sent to Tencent or ByteDance LLM APIs. Use explicit invocation for sensitive projects, avoid running the migration script against a real database without a backup, and prefer pinned dependencies or a local-only workflow when confidentiality matters.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Context-Inappropriate Capability

Medium

Confidence: 78% confidence
Finding: The documentation instructs the agent to write temporary Python files, invoke local interpreters, and run PowerShell commands. For a business-domain costing skill, that materially expands behavior into arbitrary local code execution patterns, increasing the chance of unsafe command construction, abuse of local resources, or execution of attacker-influenced input.

Description-Behavior Mismatch

Medium

Confidence: 84% confidence
Finding: The script sends potentially sensitive user work descriptions to external LLM providers even though the skill metadata emphasizes local quota lookup and embedded local reference data. In a cost-estimation/quotation workflow, user inputs may include project names, site details, pricing context, or proprietary scope information, causing unintended third-party disclosure.

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The function claims to generate a temporary token using Tencent Cloud signature logic, but actually returns a raw 'SecretId:SecretKey' concatenation. If this function is used as an authorization token, it risks exposing long-lived cloud credentials in transit or logs and misleads maintainers into believing a safer ephemeral credential mechanism exists.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The trigger phrases are broad and include common-language requests such as '帮我查一下', '生成报价表', and generic domain terms. This raises the risk of unintended activation, which in this skill is more significant because activation may lead to local file/database access and outbound calls to external LLM providers.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: User input is transmitted off-system to third-party LLM APIs without an explicit warning or consent mechanism in the script. Because the skill operates on engineering costing content, the data may include commercially sensitive project descriptions that users reasonably expect to stay local.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The script unconditionally deletes the existing SQLite database with DB_PATH.unlink() before recreating it, with no confirmation, backup, atomic replacement, or guardrail. If run in the wrong environment or against a populated production/working database, this causes immediate data loss and service disruption; while not an attacker-driven code execution issue, it is a real destructive safety flaw.

Unpinned Dependencies

Low

Category: Supply Chain
Content: # cnsdoce 技能依赖 pandas>=1.5.0 openpyxl>=3.0.0 sentence-transformers>=2.2.0 chromadb>=0.4.0
Confidence: 92% confidence
Finding: pandas>=1.5.0

Unpinned Dependencies

Low

Category: Supply Chain
Content: # cnsdoce 技能依赖 pandas>=1.5.0 openpyxl>=3.0.0 sentence-transformers>=2.2.0 chromadb>=0.4.0 faiss-cpu>=1.7.0
Confidence: 94% confidence
Finding: openpyxl>=3.0.0

Unpinned Dependencies

Low

Category: Supply Chain
Content: # cnsdoce 技能依赖 pandas>=1.5.0 openpyxl>=3.0.0 sentence-transformers>=2.2.0 chromadb>=0.4.0 faiss-cpu>=1.7.0
Confidence: 91% confidence
Finding: sentence-transformers>=2.2.0

Unpinned Dependencies

Low

Category: Supply Chain
Content: pandas>=1.5.0 openpyxl>=3.0.0 sentence-transformers>=2.2.0 chromadb>=0.4.0 faiss-cpu>=1.7.0 # LLM API调用依赖 *(2026-05新增)*
Confidence: 97% confidence
Finding: chromadb>=0.4.0

Unpinned Dependencies

Low

Category: Supply Chain
Content: openpyxl>=3.0.0 sentence-transformers>=2.2.0 chromadb>=0.4.0 faiss-cpu>=1.7.0 # LLM API调用依赖 *(2026-05新增)* volcengine-python-sdk>=0.1.0 # 豆包API（优先使用，有免费额度）
Confidence: 88% confidence
Finding: faiss-cpu>=1.7.0

Known Vulnerable Dependency: chromadb — 1 advisory(ies): CVE-2026-45829 (ChromaDB Python project has a pre-authentication code injection vulnerability)

Critical

Category: Supply Chain
Confidence: 98% confidence
Finding: chromadb

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High

Category: Supply Chain
Confidence: 87% confidence
Finding: requests

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/llm_semantic_match.py:353