Back to skill

Security audit

scalingup-daily

Security checks across malware telemetry and agentic risk

Overview

This skill mostly matches its stated report-generation purpose, but it needs review because it automates scraping and publishes generated reports using stored credentials.

Install only if you are comfortable with automated WeChat/Sogou scraping and with generated reports being uploaded to IMA and Tencent Docs. Before enabling the weekly task, review report contents, restrict credential file permissions, avoid shared machines, and verify the IMA helper scripts come from a trusted installation.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (13)

Lp3

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding
The skill instructs use of shell commands, local file access, and network operations, but does not declare permissions or surface those capabilities explicitly. This weakens user consent and sandboxing expectations, especially because the workflow reads local credential files and performs external uploads.

Tp4

High
Category
MCP Tool Poisoning
Confidence
74% confidence
Finding
The stated purpose is daily report generation and sync, but the implementation behavior expands into web scraping via Sogou/WeChat search flows, including cookie handling and redirect resolution on third-party domains. That broader data collection behavior is not clearly disclosed, which can bypass user expectations and increase legal, privacy, and operational risk.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The code deliberately rotates among a pool of browser User-Agent strings with a comment explicitly stating the goal is to avoid a fixed fingerprint. That is anti-bot evasion behavior, which increases the skill's ability to bypass service protections and makes the collection workflow more likely to violate platform access controls or terms.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The script fetches cookies from an unrelated Sogou video endpoint and reuses them to access WeChat search pages and resolve article links, which is clear anti-crawler bypass logic. This goes beyond normal content retrieval and materially increases the capability to circumvent rate limits or anti-automation defenses of a third-party service.

Context-Inappropriate Capability

Medium
Confidence
89% confidence
Finding
The redirect-resolution logic parses meta refresh, JavaScript redirects, and concatenated URL fragments to reconstruct the final mp.weixin.qq.com URL. This is not just passive search parsing; it is designed to defeat indirection layers and extract destination links that the source platform is intentionally mediating, expanding the scraping capability of the skill.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The installation guide explicitly states the skill will synchronize generated reports to IMA and Tencent Docs, but it does not clearly warn users that report contents are transmitted to external services and may leave the local environment. In a workflow that aggregates potentially sensitive research notes, internal summaries, or proprietary selections, this omission can lead to unintended data disclosure through automation.

Missing User Warnings

High
Confidence
97% confidence
Finding
The guide instructs users to store IMA client_id and api_key as plaintext files under ~/.config/ima without any permissions hardening, secret-store guidance, or warnings about local exposure. Plaintext API credentials are vulnerable to accidental disclosure through backups, shared accounts, lax filesystem permissions, or malware, and compromise would allow unauthorized access to the connected knowledge-base environment.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill mandates uploading generated content to external platforms and specifies credential-backed integrations, but provides no user-facing warning about outbound data transfer. In a workflow that may include unpublished research summaries, internal notes, or sensitive context, silent synchronization can cause unintended disclosure to third-party services.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill explicitly points to local credential file paths, implying the agent may read secrets from the host filesystem during execution without a prominent warning or scoped secret-management mechanism. This increases the chance of overbroad secret access and accidental exposure through logs, subprocesses, or compromised downstream tools.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The script passes temporary COS credentials to a child process via command-line arguments, exposing them to local process inspection tools and potentially to logs or diagnostics. In this skill context, the script is specifically automating uploads to a remote knowledge base, so mishandling cloud credentials increases the chance of credential leakage during normal operation.

Unvalidated Output Injection

High
Category
Output Handling
Content
return managed_node
    
    # 尝试系统 node
    result = subprocess.run(["which", "node"], capture_output=True, text=True)
    if result.returncode == 0:
        return result.stdout.strip()
Confidence
82% confidence
Finding
subprocess.run(["which", "node"], capture_output

Unvalidated Output Injection

High
Category
Output Handling
Content
"--expired-time", str(cos_credential["expired_time"])
    ]
    
    result_cos = subprocess.run(cos_cmd, capture_output=True, text=True)
    print("COS stdout:", result_cos.stdout)
    if result_cos.stderr:
        print("COS stderr:", result_cos.stderr)
Confidence
90% confidence
Finding
subprocess.run(cos_cmd, capture_output

Unpinned Dependencies

Low
Category
Supply Chain
Content
"description": "搜广推领域模型 Scaling Up 日报生成技能",
  "private": true,
  "dependencies": {
    "cheerio": "^1.0.0"
  }
}
Confidence
89% confidence
Finding
"cheerio": "^1.0.0"

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.