Security audit

标前分析助手-投标前必查的一份报告

Security checks across malware telemetry and agentic risk

Overview

The skill is a coherent bid-analysis assistant, but it needs review because it can collect a hashed device identifier, persist an API key, and export shareable reports containing login-bypass signed links.

Install only if you are comfortable with the vendor API workflow: the skill may create a trial account after consent, send a hashed MAC-derived device identifier for trial de-duplication, store an API key locally, and write reports to your home directory. Treat generated HTML reports and copied links as sensitive because they may contain signed access parameters; avoid sharing them outside the intended audience.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill instructs local file reads and writes (reading user-provided files, writing reports) but does not declare corresponding permissions in a manifest-like way. This creates a transparency and consent gap: the host or reviewer cannot accurately reason about the skill’s data-access surface, and users may not expect local filesystem operations beyond analysis. In this context, the danger is moderate because the file access appears related to report generation rather than overtly exfiltrative, but undeclared capabilities still weaken trust boundaries.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 89% confidence
Finding: The declared purpose is pre-bid analysis, but the skill also defaults to generating branded HTML artifacts with embedded platform links and marketing entry points. This expands behavior from analysis into content generation and promotional distribution, which can surprise users, increase data exposure in exported artifacts, and create an opportunity to include tracking or sensitive signed URLs in shareable files. The context makes this more dangerous because the report explicitly reuses API-returned URLs with `sk` parameters, so an exported report may carry live access tokens or signed links beyond the immediate session.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The skill instructs automatic trial-account registration and local credential persistence, even though its stated purpose is bid analysis rather than account management. This broadens the data-handling surface by collecting device-derived identifiers and storing API credentials locally, which introduces privacy and credential-security risks if storage is insecure or consent is not fully informed. The risk is elevated by the skill’s encouragement to auto-register as a fallback path, making potentially sensitive side effects part of the normal workflow.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: This document embeds an automatic account-provisioning flow, device fingerprint collection, remote registration, and API key persistence inside a skill whose stated purpose is pre-bid analysis. That is a material scope mismatch: users invoking a bid-analysis assistant would not reasonably expect local device identifiers to be collected and credentials to be written to disk, which creates hidden privacy, consent, and secret-management risk.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The skill instructs the agent to collect platform, architecture, and a hashed MAC-derived identifier, then use them to auto-register accounts and de-duplicate free trials. Even though the raw MAC is hashed, this is still persistent device fingerprinting tied to account issuance, and the behavior is not necessary for delivering bid-analysis functionality, making it an unjustified privacy-invasive capability.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The template explicitly requires preserving and redistributing full signed `url` values containing `sk` parameters, including in the chat output and exported HTML. If `sk` functions as a bearer-style access token or login bypass signature, sharing it broadens access beyond the minimum needed for bid analysis and can expose authenticated resources to unintended recipients.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The skill documentation expands behavior from generating an in-chat analysis to writing JSON to disk and executing a local Python script by default. This increases the attack surface and operational side effects, especially if report content or filenames derive from untrusted project names or external data, and it violates least-privilege for a reporting skill.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The template instructs the agent to create a user-accessible HTML file automatically without clearly warning the user that local files will be written and where they will be stored. Silent persistence can leak sensitive business analysis to shared machines, synced home directories, or later users, and surprises users with side effects outside the chat context.

Ssd 3

High

Confidence: 99% confidence
Finding: The document mandates reuse of signed access parameters in URLs and describes `sk` as necessary to bypass a login wall, which strongly indicates the links confer authenticated access. Embedding and sharing such URLs in reports and exported artifacts can leak bearer-like credentials, enable unauthorized access, and facilitate uncontrolled redistribution of protected resources.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.