China Consumer Electronics Suppliers

• Outcome: Review
• Latest audit: May 29, 2026 at 9:25 PM UTC
• Version:
  1.0.1

Overview

This is a local supplier guide, but it includes a structured factory contact list despite saying it has no individual supplier contacts.

Review before installing if you are uncomfortable with bundled corporate supplier emails. The code appears local and read-only, but the contact list should not be treated as verified or used for spam, bulk outreach, or sensitive profiling.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence
• Finding: The skill declares no permissions while the implementation reportedly performs file reads, creating a capability mismatch between what users/platform reviewers are told and what the code can actually do. Even if the current description says it only reads local structured data, undeclared file access reduces transparency and can enable unintended access to workspace files or future abuse without clear consent boundaries.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The file goes beyond high-level industry guidance and includes a structured directory of named factories with direct email contacts. Even if these are corporate addresses, bundling them into a machine-readable supplier list enables unsolicited outreach, spam, profiling, or repurposing for mass contact workflows that are not clearly necessary for the stated guide purpose.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The presence of a factory outreach directory changes the skill from an informational market guide into a contact-enablement dataset. That mismatch increases misuse risk because downstream agents can leverage the JSON for lead generation, bulk supplier solicitation, or automated outreach in ways not implied by the declared scope.

Vague Triggers

Low

• Confidence: 82% confidence
• Finding: The contact data is provided without policy, provenance limits, or operational constraints, making it easy to reuse in unintended contexts such as scraping, enrichment, automated sales outreach, or reputation-sensitive targeting. The risk is lower because the data appears to be business contact information rather than secrets, but the unconstrained structured format still creates a security and abuse concern.

VirusTotal

65/65 vendors flagged this skill as clean.