Security audit

YC Resource Import

Security checks across malware telemetry and agentic risk

Overview

The skill appears to be a contract/resource ingestion tool, but it can change production CSV/database data, archive or delete files, and perform online enrichment without clearly bounded user control.

Review before installing. Use this only on approved contract folders and non-production test CSVs first. Require an explicit dry run, confirmation before any production append/archive/delete step, and opt-in network enrichment that states what contract-derived data may be sent externally.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill instructs the agent to read local/cloud files, create directories, write CSVs, archive source contracts, and delete temporary files, but it does not declare corresponding permissions. This creates a transparency and control gap: operators may invoke a skill that performs filesystem actions without an explicit permission model, increasing the risk of unintended data exposure or modification.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The script claims strict field/header alignment, but it does not enforce schema matching before writing. It silently maps missing fields to empty strings via row.get(fn, ''), which can corrupt production data integrity, omit required values, and undermine downstream compliance or business logic that assumes complete records.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger phrases include broad terms like '资源入库', '解析入库', and '合同解析', which can overlap with normal conversation or adjacent workflows. In this skill, accidental invocation is more dangerous because the documented actions include file pulling, parsing, CSV generation, filesystem changes, and optional production database appends.

Missing User Warnings

High

Confidence: 93% confidence
Finding: The skill describes impactful operations on user data and the filesystem, including appending to production databases, automatically creating paths, archiving original contracts, and deleting temporary files, without a clear risk notice or consent boundary. In a production-ingestion context, accidental or misunderstood execution could alter business data, retain sensitive contracts in unintended locations, or remove artifacts needed for audit and recovery.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill states it will automatically query public sources to fill missing fields, but it does not clearly disclose that this requires network access and may transmit document-derived entities or lookup terms externally. Because the documents are contracts and may contain sensitive business information, silent enrichment increases confidentiality and compliance risk even if only selected fields are being completed.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The code rewrites the production CSV in place using write mode, which is destructive if the process crashes, disk fills, or malformed input is provided during the operation. In a production import skill, this can lead to partial writes, data loss, or irreversible corruption of the authoritative CSV store.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.