Global Skill Daily

• Outcome: Review
• Latest audit: Jul 20, 2026 · 12:14 PM UTC
• Version: 1.5.0

Overview

The skill’s main workflow is disclosed, but it scans sensitive local context by default and publishes reports that still contain context-derived signals despite claiming otherwise.

Review before installing. Run with --dry-run first, inspect data/user_context_*.json and data/recommended/*.md, and use --no-context-scan for privacy-sensitive environments. Disable destinations you do not need with --no-feishu, --no-ima, and --no-obsidian, and provide least-privilege Feishu/IMA credentials only if you are comfortable publishing the generated digest externally.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 87% confidence
• Finding: The skill description understates or ambiguously describes behavior that includes broad local context scanning, optional external CLI invocation, and generation of recommendation content influenced by scanned user/project data. That mismatch can cause users to consent to a seemingly limited recommendation workflow without fully understanding that local files, installed skills, and experience backups may be analyzed and that resulting content is sent to external services, increasing privacy and informed-consent risk.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The executor scans local user context by default unless the operator explicitly opts out with --no-context-scan. In a recommendation skill, default collection of local memory, project files, experience backups, and installed skills expands access to potentially sensitive data and can violate the principle of least privilege, especially since later pipeline stages publish derived outputs to multiple destinations.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The markdown claims the published report contains no context-derived content, but the code includes user-context-derived signals such as memory match weights, matched-count statistics, and personalized summaries in recommendation output. Even without raw keywords, these derived features can reveal user interests, projects, or installed-skill patterns when the report is stored or shared externally, making the privacy claim materially misleading.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The text promises raw scan results remain local and are not pushed to external services, but the generated report still contains directly exportable derivatives of that local scan. Derived data can still leak sensitive behavioral or operational information, so the distinction between 'raw' and 'derived' does not make the disclosure safe in this reporting context.

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: The implementation adds developer profiling and cross-platform ecosystem analysis beyond the stated '10-dimension recommendations' and 'aggregate counts only' boundary. Scope expansion matters here because richer profiling output increases the chance of disclosing sensitive inferred information and undermines user expectations about what this skill publishes.

Context-Inappropriate Capability

Medium

• Confidence: 83% confidence
• Finding: The script harvests Feishu app credentials and a user open_id from the environment, then uses them to publish outbound messages. In this skill's context, that adds an exfiltration/publication channel beyond mere local scanning and recommendation, increasing risk if scan content includes sensitive or policy-restricted data.

Context-Inappropriate Capability

Medium

• Confidence: 82% confidence
• Finding: The code invokes an external lark-cli binary for cloud upload despite the skill being described as standard-library-only and scanner/recommender-oriented. That creates an undeclared dependency and an additional execution and data-export path, which is more dangerous in a skill expected to operate locally with minimal trust assumptions.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The manifest claims derived reports publish only aggregated counts, but the card payload includes per-skill names, slugs, platform presence, install counts, and summaries. This is a direct mismatch between stated behavior and actual data disclosure, meaning the skill can export materially richer scan-derived content than users or reviewers were led to expect.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The push flow uploads the full markdown report to Feishu cloud storage, contradicting the claim that raw scan outputs remain local and only aggregate counts are published. In context, this is especially risky because the file can contain the complete derived report and moves it to third-party cloud storage under user identity.

Description-Behavior Mismatch

High

• Confidence: 93% confidence
• Finding: The script sends full markdown content to a third-party IMA service via authenticated API calls, while the skill description says raw scan data should remain local and only aggregated derivative content should be published. This creates a real data-boundary violation: if the markdown includes raw scan output, memory-derived content, or other sensitive details, the code can exfiltrate more data than the declared scope allows.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The script persists a rich derived profile to disk, including weighted keywords, active project names, experience file names, installed skills, and memory-derived summaries. That exceeds an aggregate-only interpretation of the skill metadata and creates a durable local artifact that can reveal user interests, work context, and environment details even if raw memory contents are not stored.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The script enumerates ~/.trae-cn/skills and records all installed skill names, directly enabling local skill ecosystem analysis that the manifest says the skill should not perform. Installed skill inventories can expose user workflows, tooling preferences, and sensitive operational focus areas, and the data is then persisted into the output JSON.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script writes JSON and markdown artifacts containing context-derived recommendation signals without any warning, confirmation, or separation between local-only and shareable outputs in this code path. In a skill designed to publish reports to multiple destinations, silent persistence of personalized derivatives increases the risk of accidental disclosure.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script collects and writes user-context data to a JSON file without any user-facing disclosure, consent, or opportunity to review what will be stored. Even with the sensitive-keyword blocklist, the output still contains potentially identifying metadata such as project names, knowledge file names, installed skills, and inferred interests, which creates a privacy and transparency risk.

External Transmission

Medium

• Category: Data Exfiltration

Content

13. **派生报告零上下文派生内容（v1.4.0 强化）**：报告 markdown 中「用户上下文快照」段只发布聚合计数（关键词数/项目数/经验文件数/已装 skill 数）。**禁止发布任何上下文派生内容**（含 Top 10 关键词列表、项目名、经验文件名、已装 skill 列表）到外部服务。原始扫描结果仅存本地 `data/user_context_{date}.json`。
14. **上下文扫描可跳过（v1.3.0）**：`--no-context-scan` 完全跳过 TRAE memory / 项目文件 / 经验备份 / 已装 skill 扫描，推荐降级为 trending-only（无 memory_collision / scene_match 维度）。用于隐私敏感场景或调度器环境。
15. **自依赖改造（v1.5.0）**：所有 Python 脚本仅依赖标准库（urllib/json/re/sys/os/pathlib/datetime/collections），禁止 `pip install` 第三方包。`fetch_clawhub.py` 用 `urllib.request` 替代 `requests`；`fetch_skillhub.py` 直连 SkillHub HTTP API 替代 `skillhub` CLI；`push_to_feishu.py` 中 `lark-cli` 改为可选依赖，不可用时降级为仅卡片消息（卡片已含完整简报文本）。
16. **SkillHub 直连 HTTP API（v1.5.0）**：`fetch_skillhub.py` 直接调用 `https://api.skillhub.cn/api/v1/showcase/{type}` 和 `/api/v1/search`，无需 `skillhub` CLI 二进制依赖。6 个排行榜类型：hot/featured/newest/recommended/trending/paid。

## 示例

• Confidence: 81% confidence
• Finding: https://api.skillhub.cn/

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.