上架前合规校验 Platform Compliance

• Outcome: Review
• Latest audit: Aug 31, 2026 · 7:22 AM UTC
• Version: 1.0.1

Overview

The main compliance checker is local and coherent, but the package also includes broader generation tooling that can send prompts and images to external AI providers outside the stated compliance-checking scope.

Review this skill before installing if you handle sensitive or pre-release product images. The documented compliance checker can be used locally with scripts/check_listing.py, but avoid invoking scripts/gen.mjs or the provider CLI path unless you intentionally want external AI processing and are comfortable with the selected provider receiving prompts and images.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The implementation exposed here is a generic generation runner with task/model/provider selection rather than a platform-compliance checker as described in the skill metadata. This mismatch is dangerous because users may provide product images and trust the skill to perform compliance review, while the code instead routes prompts and images to external generation backends, creating undisclosed data transfer and functionality that does not enforce the promised safety or review behavior.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The script can select from multiple external providers and send prompt/image content to whichever backend is configured, but the declared purpose is compliance auditing rather than arbitrary generation. In this context, that broad outbound capability increases the risk of unnecessary exfiltration of sensitive product assets, branding materials, or pre-release listings to third parties without clear justification or scope control.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: This module is a generic AI media generation/router layer that can generate or edit images and videos across multiple third-party providers, which materially exceeds the declared purpose of a platform-compliance checking skill. In this context, that scope mismatch is dangerous because it enables arbitrary content transformation and external data handling under the guise of a compliance tool, increasing the risk of covert data exfiltration, unauthorized content modification, and user deception.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The code imports child_process spawning support and later executes an external CLI backend, introducing arbitrary local executable invocation into a skill that is described as a compliance checker. Even without shell injection, spawning external tools broadens the trust boundary and creates risk from malicious binaries, unsafe local configuration, or unexpected side effects on the host environment.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The module sends prompts and images to several external AI providers including OpenAI, Gemini, fal, Replicate, and Ark, which is much broader than the advertised compliance-checking scope. In a compliance skill context, broad outbound routing increases the chance that sensitive product images, drafts, or proprietary content are transmitted to third parties without clear necessity or predictable data governance.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The skill hard-codes a protected characteristic ('East Asian woman') into a shared brand configuration that is reused across image-generation workflows, which can systematically steer outputs toward a specific ethnicity without user request or clear business necessity. In a commerce/content pipeline, this creates discrimination, representation, and compliance risk, especially because the setting appears global and broadly reused across many SKUs.

Missing User Warnings

Medium

• Confidence: 81% confidence
• Finding: The helper functions convert local files or remote URLs into base64/data URIs for later transmission, but this file contains no mechanism for informing users that their prompts and images may be uploaded to external providers. In a tool handling pre-release marketplace assets, lack of transparent disclosure can lead to unintentional sharing of sensitive or proprietary content.

External Transmission

Medium

• Category: Data Exfiltration

Content

: await readFile(p)
        fd.append('image[]', new Blob([buf], { type: mimeOf(p) }), path.basename(p))
      }
      r = await fetch('https://api.openai.com/v1/images/edits', {
        method: 'POST', headers: { authorization: `Bearer ${key}` }, body: fd,
      })
    } else {

• Confidence: 92% confidence
• Finding: This finding duplicates the actual OpenAI edit upload path and represents real external transmission of user media and prompts. The danger is exposure of proprietary images and content to a third-party provider under a skill whose stated purpose suggests narrower processing.

External Transmission

Medium

• Category: Data Exfiltration

Content

method: 'POST', headers: { authorization: `Bearer ${key}` }, body: fd,
      })
    } else {
      r = await fetch('https://api.openai.com/v1/images/generations', {
        method: 'POST',
        headers: { authorization: `Bearer ${key}`, 'content-type': 'application/json' },
        body: JSON.stringify({

• Confidence: 90% confidence
• Finding: This is the actual OpenAI image generation POST and therefore a genuine external transmission point. In context, it expands the skill from compliance checking into third-party content generation, which raises confidentiality and expectation-management risks.

External Transmission

Medium

• Category: Data Exfiltration

Content

: await readFile(p)
        fd.append('image[]', new Blob([buf], { type: mimeOf(p) }), path.basename(p))
      }
      r = await fetch('https://api.openai.com/v1/images/edits', {
        method: 'POST', headers: { authorization: `Bearer ${key}` }, body: fd,
      })
    } else {

• Confidence: 92% confidence
• Finding: This finding duplicates the actual OpenAI edit upload path and represents real external transmission of user media and prompts. The danger is exposure of proprietary images and content to a third-party provider under a skill whose stated purpose suggests narrower processing.

External Transmission

Medium

• Category: Data Exfiltration

Content

method: 'POST', headers: { authorization: `Bearer ${key}` }, body: fd,
      })
    } else {
      r = await fetch('https://api.openai.com/v1/images/generations', {
        method: 'POST',
        headers: { authorization: `Bearer ${key}`, 'content-type': 'application/json' },
        body: JSON.stringify({

• Confidence: 90% confidence
• Finding: This is the actual OpenAI image generation POST and therefore a genuine external transmission point. In context, it expands the skill from compliance checking into third-party content generation, which raises confidentiality and expectation-management risks.

External Transmission

Medium

• Category: Data Exfiltration

Content

const input = { prompt: req.prompt, num_outputs: req.batch }
    if (req.images?.length) input.input_image = await asDataUri(req.images[0])
    const j = await postJson(
      `https://api.replicate.com/v1/models/${replicate.model(req)}/predictions`,
      { input },
      { authorization: `Bearer ${env.REPLICATE_API_TOKEN}`, prefer: 'wait' },
      req.timeoutMs,

• Confidence: 90% confidence
• Finding: This call sends prompt data and possibly an input image to Replicate, which is a real third-party data transmission. For a platform-compliance skill, this is risky because product imagery and pre-publication content may be shared externally without the narrow necessity implied by the manifest.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/lib/providers.mjs:104

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/gen.mjs:118

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/lib/providers.mjs:21