Security audit

质量成本分析技能

Security checks across malware telemetry and agentic risk

Overview

The skill matches its stated quality-cost reporting purpose, but it has under-disclosed report-time network script loading and unsafe pickle deserialization risks.

Install only if you are comfortable processing business cost data with local scripts that write intermediate files and HTML reports. Do not run the calculator on pickle files from untrusted sources, and treat generated HTML reports as network-dependent unless Plotly is bundled locally or the CDN dependency is removed.

SkillSpector

By NVIDIA

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill clearly instructs reading user-supplied Excel/CSV files and writing multiple output artifacts such as cleaned data, JSON results, chart HTML, and final reports, but it does not declare corresponding permissions. This creates a transparency and policy-enforcement gap: an orchestrator or reviewer may underestimate the skill’s file access scope, increasing the chance of unintended file reads/writes.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The template loads Plotly from an external CDN at report-view time, which introduces third-party network dependency and remote script execution into what appears to be a local analysis/reporting skill. If the CDN response is tampered with, blocked, or replaced, opening the generated report could execute attacker-controlled JavaScript or fail unexpectedly, creating supply-chain and privacy risks.

Intent-Code Divergence

Medium

Confidence: 99% confidence
Finding: The script accepts a user-supplied .pkl path and loads it with pandas.read_pickle, which can execute arbitrary code during deserialization. In a skill or agent environment where inputs may come from untrusted users or files, this turns a data-analysis operation into a remote code execution primitive.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The generated HTML depends on Plotly JavaScript loaded from a remote CDN, which introduces a supply-chain and availability dependency outside the local trust boundary. If the CDN is blocked, unavailable, or serves tampered content, report rendering can fail or execute attacker-controlled JavaScript in the context where the HTML is opened.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger conditions are broad enough that the skill could be invoked for many loosely related requests about cost, trends, or reporting without clear user intent to authorize file processing and report generation. Over-broad activation increases the risk of unnecessary access to user files and unexpected execution of data-processing steps.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: Although the workflow implies reading Excel/CSV inputs and generating HTML reports and intermediate files, the documentation does not prominently warn users about these file operations, data persistence, or where outputs are stored. This can lead to surprise writes, accidental exposure of sensitive business data in generated artifacts, and weak informed consent for handling user files.

Missing User Warnings

Low

Confidence: 91% confidence
Finding: The HTML explicitly includes a remote Plotly script without informing the user that opening the report may contact a third-party service. This creates a privacy and trust issue because viewing a supposedly local report can trigger outbound network requests and inherit the risks of remote script execution.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.