Security audit

Dknowc Gov Zhicha

Security checks across malware telemetry and agentic risk

Overview

This government Q&A skill is mostly coherent, but its setup handles phone/SMS verification and can be redirected to arbitrary registration endpoints while saving an API key locally.

Review before installing. Use the default official DKnowC endpoints only, do not pass custom --base or --endpoint values unless you fully trust them, and treat the phone number, SMS code, and generated config.ini as sensitive. After setup, do not share or republish the installed skill directory unless config.ini has been removed.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The script implements account registration, SMS verification handling, API key issuance, and local credential persistence, which materially exceeds the declared purpose of a government-policy Q&A/retrieval skill. This hidden capability increases attack surface and can create or manage external service identities without clear user expectation or manifest disclosure.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: Allowing an arbitrary --base URL lets the script send phone numbers, verification codes, and registration payloads to any attacker-controlled endpoint instead of the expected service. In a skill that should only retrieve authoritative government information, this is an unjustified exfiltration path for sensitive onboarding data and issued credentials.

Natural-Language Policy Violations

Medium

Confidence: 91% confidence
Finding: The changelog states the default region was changed to "中国" and that user-specified regions override it, which means the skill still injects a geographic assumption when the user provides none. In a government-services skill, silent defaulting can mislead users into receiving jurisdiction-specific eligibility, process, or policy guidance that may not match their actual location.

Natural-Language Policy Violations

Medium

Confidence: 98% confidence
Finding: These entries explicitly describe a default-to-Shenzhen behavior when the user does not specify a region. For a政务/public-services skill, this can produce incorrect legal, benefits, permit, or procedural advice tied to Shenzhen, creating a meaningful risk of misinformation and failed real-world actions by users outside that jurisdiction.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The README instructs the agent to collect a user's phone number and SMS verification code, then automatically obtain and persist an API key in a local config file, but it does not provide clear security guidance for handling these sensitive values. In an agent-driven workflow, this increases the risk of exposing personal data, OTPs, or credentials through logs, chat history, screenshots, shell history, or unintended file sharing.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The register flow writes a returned API key into config.ini automatically, creating a durable secret on disk with only inline comments in the file rather than an explicit user warning at write time. Persistent local storage of credentials raises the risk of accidental inclusion in packaging, backups, logs, or later disclosure by other tooling.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.