深知可信搜索（法律、政策、标准）

• Outcome: Review
• Latest audit: Sep 2, 2026 · 6:22 AM UTC
• Version: 1.1.5

Overview

This appears to be a real trusted-search integration, but it needs Review because it includes phone-based account/API-key setup, endpoint overrides, and under-disclosed data handling around external searches.

Install only if you are comfortable with the agent sending policy/legal research queries to the dknowc service and, when no key is configured, asking for a phone number and SMS code to obtain an API key. Do not use endpoint override options unless you fully trust the destination, confirm where generated reports are copied, and avoid opening visualization HTML generated from untrusted structured data.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The README explicitly allows the agent to obtain an API key through a phone-verification flow and then temporarily inject it at runtime, which expands credential acquisition behavior beyond a simple preconfigured environment-variable model. This increases the chance of sensitive credential handling inside the agent workflow, creates ambiguity around consent and storage boundaries, and can lead to unintended collection or misuse of user-linked secrets.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The README requires running a delivery script that detects the host workspace and copies generated artifacts into external environments, which extends the skill's access and data movement beyond its stated scope. This creates a risk of unintended data propagation, leakage of sensitive search results or reports into broader host contexts, and reduced transparency for users about where outputs are being written.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The skill description says API keys are only provided via the DKNOWC_API_KEY environment variable, but the document also embeds a workflow to collect a user's phone number, request a verification code, obtain an API key, and temporarily inject it. That creates an undocumented credential acquisition path and expands the trust boundary from passive search to identity/credential handling, increasing the risk of social engineering, mishandling secrets, and confusing users about what data is being collected.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: Embedding phone verification and API-key registration in a legal/policy search skill is dangerous because it prompts the agent to solicit personal data and participate in account provisioning that is not strictly necessary for answering the user’s query. In an adversarial or confused-deputy setting, this can normalize credential harvesting behavior and expose users to phishing-like flows under the guise of search enablement.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The script allows the destination endpoint to be overridden via a CLI flag or environment variable, which weakens the skill's intended restriction to a specific trusted service. In an agent or shared runtime, an attacker who can influence invocation parameters or environment can redirect requests and exfiltrate user queries and the API key to an attacker-controlled host.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The script does more than search-related operations: it registers accounts, retrieves API keys, and can return raw credentials to the caller. In a skill whose declared purpose is trusted search over legal/policy/standards sources, embedding credential provisioning materially expands the trust boundary and enables secret issuance through the skill path, which could be abused for unauthorized account/API access or exfiltration.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code contains account registration, SMS verification handling, password generation, and optional new API key creation, none of which are justified by the skill's stated search-only functionality. This creates an unnecessary credential-issuance capability inside user-facing automation, increasing the risk of abuse, shadow account creation, and bypass of normal administrative controls.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The header comment states the helper only returns a key for the current task and never writes local files, but the code can call the open API to create a new API key that is inherently persistent until revoked. This mismatch is dangerous because it understates capability, can mislead reviewers and operators, and normalizes handling long-lived secrets in an execution path that appears temporary and low-risk.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The popup script parses attacker-controlled source data from the DOM and concatenates both `s.url` and `s.title` directly into `innerHTML` without escaping. If a crafted JSON/CSV input contains a malicious title like HTML/JS payloads or a `javascript:`/quote-breaking URL, the generated report can execute script when opened, which is especially relevant because this tool renders untrusted structured data into a local HTML deliverable.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script sends user queries and optional contextual fields such as service area and effective date to an external service endpoint, but the code contains no consent, warning, or privacy gating before transmission. In a search skill focused on legal and policy research, those inputs may contain sensitive business, regulatory, or geographic context, creating a real data exposure risk if users are unaware their data leaves the local environment.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.