深知可信咨询

• Outcome: Review
• Latest audit: Sep 2, 2026 · 7:15 AM UTC
• Version: 1.1.0

Overview

The skill is coherent as a remote citation-backed policy consultant, but it gives users misleading privacy and security assurances while sending consultation content to an external service and handling API-key onboarding.

Review this carefully before installing. Use it only if you are comfortable sending consultation questions and any relevant context to dknowc's remote service, and avoid including private secrets or unnecessary sensitive personal/business data. API-key creation or persistence should require explicit consent, and delivered report paths should be checked before relying on them. The publisher should correct the 'will not be uploaded' and security-review claims before this is treated as low-risk.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Tainted flow: 'target' from os.environ.get (line 154, credential/environment) → shutil.copy2 (file write)

Medium

• Category: Data Flow

Content

continue
            target = dest / src.name
            try:
                shutil.copy2(src, target)
                results.append({
                    "copied": True,
                    "source": str(src),

• Confidence: 95% confidence
• Finding: The destination path is derived from environment variables or an explicit --dest argument and is used in shutil.copy2 without any allowlist, confinement, or path safety checks. In an agent/hosted skill context, this can redirect copied outputs to arbitrary filesystem locations writable by the process, causing unintended file placement, overwriting of same-named files in attacker-chosen directories, or leakage of generated artifacts outside the intended workspace.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The documentation tells users that '对话和材料不会上传', but the skill description explicitly states it calls a remote credibleChat API to answer consultations. This is a material misrepresentation of data handling that can mislead users into sharing sensitive policy, business, tax, or compliance information under false privacy assumptions.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The script performs SMS sending, account registration, and API key issuance/rotation, which goes materially beyond the skill’s stated consultation function. In an agent setting, this creates a privileged side-effect path that could be invoked to create or replace credentials for an external service, enabling unauthorized account provisioning or secret acquisition if a user is socially engineered or if the flow is triggered unexpectedly.

Intent-Code Divergence

High

• Confidence: 94% confidence
• Finding: The header comment asserts the helper only returns a key for the current task and never writes local files, but the implementation can register accounts and create new persistent API keys on the remote platform. This mismatch is dangerous because reviewers and users may underestimate the sensitivity and persistence of the action, leading to consent bypass, weak scrutiny, and accidental credential lifecycle changes.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The script performs a pre-check for unbound citations using the original source IDs, but later `renumber_citations()` and especially `align_sources_to_answer()` can rewrite source IDs to match the answer by position. In a verification/reporting tool, this can silently convert a citation mismatch into an apparently valid binding, undermining the integrity guarantees the report claims to provide and enabling false attribution of evidence to conclusions.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The code comment promises exact-ID matching and 'never guess by position', but `align_sources_to_answer()` does the opposite when there is no overlap between cited IDs and source IDs: it reassigns source IDs in citation order. In this skill's context, the tool is explicitly for trusted policy/compliance verification, so positional guessing can produce a misleading 'verified' report that users may rely on for legal or regulatory decisions.

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: The trigger description is very broad and covers many common policy, compliance, public-service, and business-consulting questions, which can cause the skill to activate in a large number of ordinary conversations. In this skill's context, over-triggering is more dangerous because activation can lead to network calls, local file generation, and user onboarding flows involving phone verification and API-key acquisition, increasing data exposure and unnecessary credential-handling opportunities.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.