Security audit

HACCP技能

Security checks across malware telemetry and agentic risk

Overview

This skill is a HACCP planning aid that writes draft tables and Excel files, with no evidence of hidden access, persistence, exfiltration, or destructive behavior.

Treat outputs as draft HACCP planning support, not a validated regulatory or operational food-safety plan. Before installing, note the 11/12-column inconsistency and have qualified food-safety staff verify all critical limits, CCP choices, defaults, and records before use.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 88% confidence
Finding: The skill claims to generate a standards-compliant 11-column HACCP plan and perform hazard analysis/CCP determination, but the described implementation appears to only export provided data and even uses a 12-column table. In a food safety workflow, this mismatch can mislead users into trusting incomplete or noncompliant outputs, causing unsafe operational decisions or regulatory errors.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: Broad trigger phrases such as '帮我分析生产流程' or similar expressions may cause the skill to activate in situations beyond intended HACCP planning. Unintended invocation can lead to irrelevant or misleading food-safety outputs being inserted into other workflows, especially because the skill uses defaults and placeholders that may be mistaken for validated guidance.

VirusTotal

61/61 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.