Security audit

Dknowc Gov Zhicha

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed government-service Q&A integration that requires first-use phone registration and stores a local API key, so it is acceptable but not risk-free.

Install only if you are comfortable sending your phone number, SMS verification code, and later government-service questions to Dknowc's external service. Treat the generated config.ini as a secret because it contains an API key; avoid committing or sharing the skill directory after registration, and rotate/delete the key if the machine is shared or compromised.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill instructions require local file checks for config.ini, invoke registration scripts, and call a remote API endpoint, which means the skill exercises file access and network capabilities while no permissions are declared. This creates a real trust and governance issue because users and hosting platforms cannot accurately assess or constrain what the skill is allowed to do, especially since it handles phone numbers, verification codes, and locally stored API credentials.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The script explicitly implements headless user registration, SMS verification flow support, and local API-key persistence, which goes beyond the declared skill purpose of answering public-service/policy questions. This creates an additional account lifecycle and secret-handling surface that can be abused for unauthorized account provisioning, key sprawl, or operation outside expected user consent and platform review boundaries.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The register path collects a phone number and verification code, creates an account, receives an API key from the remote service, and writes that secret into config.ini for later use. In the context of a public-service query skill, embedding account onboarding and key issuance is unnecessary and increases the risk of silent credential creation, misuse of user-supplied verification codes, and long-lived secret exposure within the skill directory.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The changelog explicitly states that a registration script obtains an API key and automatically writes it into a local config.ini file, but there is no accompanying warning about credential storage, file modification, local path, permissions, or safe handling. This creates a real security risk because users may unknowingly persist secrets in plaintext on disk, increasing the chance of credential leakage through backups, source control, shared environments, or other local tooling.

Natural-Language Policy Violations

Medium

Confidence: 84% confidence
Finding: The changelog says the default region is set to China unless the user specifies otherwise. In a government-policy lookup skill, silently applying a jurisdiction without explicit user choice can produce inaccurate or overbroad policy guidance, which is security-relevant because users may act on the wrong official requirements or eligibility criteria.

Natural-Language Policy Violations

Medium

Confidence: 91% confidence
Finding: These entries document a prior behavior where Shenzhen was used as the default region whenever the user did not specify one. In the context of政务办事 and public-service guidance, this can mislead users into following the wrong city-level rules, materials, or procedures, which makes the issue more dangerous than a generic locale default because local policy differences are often legally significant.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The README instructs the agent to perform phone-based account registration, SMS verification handling, API key acquisition, and local credential storage, but it does not clearly warn users about the privacy, consent, and system-impact implications of these actions. In an agentic context, this is risky because it normalizes collecting personal data and creating persistent secrets on disk without explicit user authorization boundaries, increasing the chance of unintended account creation, sensitive data exposure, or unsafe automation.

VirusTotal

58/58 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.