Security audit

深知晓

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed public-service Q&A/search integration that uses a remote API and local API-key setup, with credential reuse gated by explicit user confirmation.

Install only if you are comfortable sending public-service, policy, tax, benefit, or business-policy questions to dknowc.cn and storing the resulting API key locally in this skill's config.ini. If you choose key reuse, confirm the source skill carefully; the flow is opt-in and same-family scoped, but it still copies a credential between installed skills.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill instructs the agent to read local files, inspect sibling skill directories for reusable credentials, and make outbound network requests, yet no explicit permissions are declared. That creates a real least-privilege and transparency problem: users may not understand that invoking a government Q&A skill can trigger local filesystem inspection and credential-handling flows, increasing the chance of unintended secret exposure or overbroad access.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 84% confidence
Finding: The skill is presented as a trusted government/public-service consultation tool, but its documented behavior includes local credential discovery/reuse and packaging/compliance checks unrelated to the end-user purpose. This mismatch is security-relevant because users may grant trust or provide sensitive inputs under false expectations, while the agent performs broader local and operational actions than the description implies.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The script enumerates sibling skill directories, reads their config.ini files, extracts API keys, and can copy one into the current skill via the reuse-key flow. This breaks isolation between skills and enables unauthorized credential reuse or lateral movement if one skill can access another skill's secrets, especially because API keys grant access to external services and may belong to different trust contexts.

Natural-Language Policy Violations

Medium

Confidence: 90% confidence
Finding: The changelog states a default region of '中国' is applied when the user does not specify a locality. In a public-service and policy guidance skill, silently defaulting geographic scope can mislead users into receiving location-specific or nationally generalized guidance that may not match their actual jurisdiction, affecting compliance, eligibility, or procedural correctness.

Natural-Language Policy Violations

Medium

Confidence: 97% confidence
Finding: The documentation specifies Shenzhen as the default locale when the user does not provide a region. For government services, benefits, taxes, permits, and similar topics, city-level defaults are especially risky because rules and eligibility frequently vary by municipality, so users outside Shenzhen could receive materially incorrect guidance without realizing an assumption was made.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The README explicitly states that the obtained API key is automatically written to a local `config.ini`, but it does not clearly warn users about persistence, filesystem access risks, permissions, rotation, or removal. In this skill’s context, the agent is also encouraged to scan sibling skill directories and reuse existing keys, which increases the chance of unintended credential exposure or cross-skill secret reuse on shared or poorly isolated environments.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The script transmits the user's query and optional location/time filters to a remote third-party endpoint, which can expose sensitive personal or business information if users are unaware of the data flow. In this skill context, users may submit questions about taxes, social security, licensing, housing, or other public-service matters, increasing the chance that the payload contains personally sensitive or regulated information.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.