Security audit

Typhoon Tracker — 台风实时追踪与影响研判

Security checks across malware telemetry and agentic risk

Overview

The typhoon-analysis purpose is coherent, but the skill under-discloses mandatory local logging/case-file writes and includes unsafe publishing/install guidance.

Install only if you are comfortable with live web lookups and local persistence of typhoon case data, daily logs, and generated reports. Avoid entering unnecessary personal travel details, review or delete generated case/log files after use, rely on official emergency and transport notices for final decisions, and do not use the curl-to-bash installer from the publishing guide.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill declares no permissions, yet its instructions clearly require network access plus persistent file reads and writes. This creates an authority mismatch: hosts or users may believe the skill is low-risk while it can fetch remote content and modify workspace state, which weakens consent, review, and sandbox decisions.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 87% confidence
Finding: The skill is presented as a typhoon tracking and decision-support tool, but it also includes a document generation pipeline that invokes Python, Playwright, Chromium, HTML rendering, image handling, and PDF merging. That materially expands the attack surface beyond the stated purpose, increasing the chance of unsafe execution paths, dependency abuse, or unexpected processing of untrusted content.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The guide makes contradictory security claims: it says the skill has 'no outbound network activity' but later states it requires network access for searching/fetching data. This can mislead reviewers and users about the actual trust boundary, causing underestimation of data exfiltration, privacy, or supply-chain risk during installation and operation.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The documentation mandates creation and ongoing updates of case-data files for every new typhoon, even when the user only asked for analysis. Persistent writes without clear opt-in can store user-related queries, timestamps, locations, or derived operational notes indefinitely, exceeding what users would reasonably expect from a weather-analysis skill.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The skill claims direct text reply as the default mode, but separately requires persistent case-data writes regardless of output mode. This is dangerous because it undermines user expectations and can silently retain analysis context even when the interaction appears ephemeral.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The workflow includes mandatory workspace logging and case-data appends as part of routine operation, but those persistent side effects are not reflected in the high-level manifest description. Hidden logging broadens data retention and can expose operational history or user-provided context to other tools, collaborators, or future sessions.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The command pipes a remotely fetched script directly into bash, which executes unreviewed code from the network with the user's privileges. If the hosting server, DNS, TLS chain, or distribution path is compromised, this becomes an immediate remote code execution vector.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: The publishing instructions tell users to push and publish local skill contents without clearly warning what files, metadata, or secrets may be uploaded. This can lead to accidental disclosure of private files, tokens, internal notes, or backup artifacts if users run the commands from an unclean directory.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The README says the skill '自动触发' and provides broad natural-language examples such as asking about travel, events, or generating reports. That creates a scope ambiguity risk: an agent may invoke this skill for ordinary conversation or adjacent requests more often than users expect, causing unintended use of external data, report generation, or downstream actions in weather-related contexts. In this skill's context, the danger is moderate rather than severe because the domain is bounded to typhoon tracking, but the trigger phrasing is still broad enough to cause over-invocation and potentially unwanted processing.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The README states that each tracking cycle automatically appends measured data to local case files and generates comparison artifacts, but it does not clearly warn users that the skill writes persistent data to disk. Even if the stored content is operational rather than highly sensitive, undisclosed persistence can surprise users, create retention issues, and leak location, schedule, or analysis history if the host environment is shared or later inspected. The skill context makes this somewhat less dangerous because the stated data is typhoon case data, not obviously credentials or secrets, but automatic writes still require explicit disclosure and consent.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The skill instructs automatic generation and saving of Markdown reports under some triggers, but does not require a clear warning or confirmation before creating files. Unexpected file creation can leak sensitive analysis context into the workspace and may overwrite or proliferate documents without the user's informed consent.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill explicitly requires appending to case-data files regardless of output mode, but does not surface that persistence to the user. Silent retention is particularly risky in a tracking skill because prompts may include travel plans, locations, schedules, or emergency decisions that users did not intend to store.

Missing User Warnings

Low

Confidence: 82% confidence
Finding: The requirement to append to a daily workspace log is a persistent write side effect that is not clearly disclosed to the user. While lower severity than broad network or code execution issues, it still creates privacy and transparency concerns by retaining interaction-derived information without explicit notice.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The file instructs users to use Typhoon Bavi as an analogy baseline for similar typhoon paths, but it does not define similarity criteria, boundary conditions, or failure cases. In a safety-relevant forecasting skill, this can cause overgeneralization from a single historical case and produce misleading advice on landfall timing, transport disruption, and protective actions when the current storm differs in speed, size, steering flow, or exposure context.

External Script Fetching

High

Category: Supply Chain
Content: # 1. 安装 SkillHub CLI npm install -g skillhub-cli # 或 curl -fsSL https://skillhub.cn/install/install.sh | bash # 2. 验证安装 skillhub --version
Confidence: 98% confidence
Finding: curl -fsSL https://skillhub.cn/install/install.sh | bash

Chaining Abuse

High

Category: Tool Misuse
Content: # 1. 安装 SkillHub CLI npm install -g skillhub-cli # 或 curl -fsSL https://skillhub.cn/install/install.sh | bash # 2. 验证安装 skillhub --version
Confidence: 98% confidence
Finding: | bash

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.