Security audit

深知晓

Security checks across malware telemetry and agentic risk

Overview

The skill is a disclosed remote knowledge-service integration, but users should understand it sends queries and registration details to the provider and can reuse same-family local API keys with consent.

Install only if you are comfortable using dknowc's remote service for these questions. Your prompts may be sent to the provider, registration uses your phone number and SMS code, and API keys are stored locally in config.ini. Only approve key reuse if you trust other installed dknowc* skills and want this skill to copy a same-family API key into its own config.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 96% confidence
Finding: The skill instructs the agent to read local files (`config.ini`, `_meta.json`), scan sibling skill directories for reusable credentials, write configuration, and call external registration/search/chat endpoints, yet no permissions are declared. This creates a real capability/permission mismatch: users and hosting platforms may not realize the skill can access local filesystem state and network resources, including handling API-key bootstrap flows and phone/verification data.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The script enumerates sibling skill directories, reads their config.ini files, extracts API keys, and allows those keys to be copied into this skill. This is a cross-skill secret harvesting/reuse capability unrelated to the stated knowledge-service purpose and breaks isolation boundaries between skills, enabling unauthorized use of another skill's credentials.

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: The comments imply constrained behavior ('only writes to this skill config.ini'), but the implementation also reads secrets from neighboring skill directories for reuse. This misleading documentation can hide risky behavior from reviewers and operators, increasing the chance that cross-skill credential access is overlooked and deployed.

Natural-Language Policy Violations

Medium

Confidence: 83% confidence
Finding: The changelog states a default region of '中国' when the user does not specify location, which means the skill may infer or impose jurisdictional context without explicit user consent. In a public-service and compliance skill, region strongly affects legal, tax, benefits, and process guidance, so silent locale defaulting can produce misleading or inapplicable advice.

Natural-Language Policy Violations

High

Confidence: 97% confidence
Finding: Defaulting unanswered region to Shenzhen is more dangerous than a national default because it silently injects a specific local jurisdiction into policy, tax, permit, housing, education, and benefits answers. This can cause materially incorrect guidance, missed compliance obligations, or wrongful eligibility conclusions for users outside Shenzhen, especially in a skill explicitly positioned as authoritative and low-hallucination.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The README instructs the agent to collect a user's phone number and SMS verification code and send them through a registration flow, but it does not clearly warn that these are sensitive personal data or explain what service they are transmitted to, retained by, or protected by. In an agentic environment, this increases the risk of users disclosing credentials/verification factors without informed consent, which can enable privacy harm, account misuse, or interception if the workflow is mishandled.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The script transmits the user's prompt plus optional identifiers such as sessionId, requestId, area, and szUserId to a remote endpoint, but the CLI provides no explicit privacy notice or confirmation before sending. In a government/public-service context, prompts may contain personal or regulated data, so silent transmission increases the risk of unintended disclosure to the configured backend.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.