深知公文写作

• Outcome: Review
• Latest audit: Sep 2, 2026 · 2:36 AM UTC
• Version: 3.5.0

Overview

The skill has a real document-writing purpose, but it needs Review because it handles phone verification, account/API-key provisioning, persistent shell-profile secrets, full secret output, and automatic file delivery.

Before installing, be sure you are comfortable giving this provider a phone number and one-time code when search is needed, letting the skill save an API key in ~/.zshrc, and having generated documents copied to a detected workspace. Avoid putting sensitive internal material into search queries unless provider handling is acceptable, and remove the saved key if you stop using the service.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The script goes beyond a document-writing assistant by sending SMS verification, registering remote accounts, creating or retrieving API keys, and preparing them for ongoing use. This expands the skill into account provisioning and credential management, which materially increases security risk and is not justified by the manifest’s stated writing functionality.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code persistently modifies ~/.zshrc to store a bearer credential, creating long-lived secret exposure in a shell startup file that may be read by other tools, synced, backed up, or later disclosed. A writing skill has no need to alter shell initialization files, so the capability is unjustified and especially risky in this context.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The function provisions new remote API keys using an existing bearer token, increasing the number of valid credentials and broadening the attack surface. In a formal document-writing skill, creating new keys is unnecessary for core functionality and can enable unauthorized or poorly tracked access if logs or outputs are exposed.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README explicitly directs the agent to persist an API key into the user's `~/.zshrc`, which modifies local shell startup configuration and creates long-lived secret storage without a clear, explicit warning or opt-in focused on that file change. This increases the risk of unintended persistence, secret exposure to other local processes or users, and user surprise about environment changes, especially in an agent-driven workflow where actions may be semi-automated.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill explicitly instructs the agent to solicit a user's phone number and one-time verification code inside the conversation, which is a form of credential/secret collection. Even though the text includes some privacy assurances, those assurances are embedded in the same untrusted skill content and are not a substitute for a platform-level consent flow, clear data-handling notice, or verifiable minimization controls. This creates phishing and privacy risk because users may be trained to disclose sensitive verification data to the agent without independent trust signals.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill instructs the agent to automatically copy generated files into the host workspace via a delivery script, and to retry with an explicit destination if needed. That creates an implicit file-write side effect outside the skill boundary without requiring clear, per-action user confirmation, which can lead to unintended data placement, leakage into shared workspaces, or overwriting files in sensitive directories depending on the host integration.

Missing User Warnings

Medium

• Confidence: 75% confidence
• Finding: The script can write search results, including the user's query and retrieved official-document content, to local disk without any explicit warning, consent prompt, or retention controls. In this skill's context, queries may contain internal work topics, draft policy matters, meeting notes, or other sensitive government/enterprise material, so silent persistence increases confidentiality and data-handling risk.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The script writes a secret into ~/.zshrc automatically, without an interactive confirmation step or clear prior warning, causing persistent credential changes as a side effect of running the tool. This violates least surprise and can leave users with hidden long-term credentials they did not knowingly authorize.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The script emits the full API key in structured stdout, which can be captured by agent logs, terminal history, orchestration systems, or downstream tools and then reused by anyone with access to those records. Although it also provides a masked value, returning the complete credential defeats that protection and is particularly dangerous in automated skill environments.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/source_note_html.py:27