Security audit

finance-news-warmap

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly transparent and purpose-aligned, but users should review it because it turns web-derived data into executable HTML without clear sanitization and includes optional remote database synchronization.

Install only if you are comfortable with the skill creating or overwriting news.xlsx and a generated HTML report in the directory where it is run. Treat Supabase commands as opt-in remote synchronization and review config.toml before using them. Because the report embeds and renders news data as HTML/JavaScript, use trusted or sanitized news inputs before opening or sharing the generated file.

SkillSpector

By NVIDIA

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill explicitly describes reading and writing local files such as news.xlsx and the generated HTML, yet no permissions are declared. That mismatch can bypass operator expectations and weaken consent and sandbox policy enforcement, especially because the skill encourages execution in the user's working directory and creates/modifies deliverables there.

Description-Behavior Mismatch

Medium

Confidence: 87% confidence
Finding: The script supports `pull`/`push` operations against Supabase and `build --source supabase`, which introduces networked data synchronization behavior not clearly aligned with the skill’s stated offline/local-delivery expectations. This mismatch can cause an agent or user to invoke remote data flows unexpectedly, creating data exfiltration, trust-boundary, and deployment-assumption risks even if the final HTML artifact is offline.

Description-Behavior Mismatch

Medium

Confidence: 81% confidence
Finding: When `news.xlsx` is absent, the default path silently falls back to bundled sample data despite the skill description emphasizing '绝不编造数据'. In a decision-support context, this can mislead users into treating placeholder/sample content as real intelligence, undermining output integrity and potentially driving incorrect business decisions.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: This file introduces remote Supabase read/write capability, including credential-driven access and bulk pull/push operations, while the skill description emphasizes offline HTML generation and local bundling. Undeclared networked persistence expands the skill’s effective permissions and data flow, which can surprise operators, bypass least-privilege expectations, and enable unintended exfiltration or retention of scraped/news data.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The code can upload and retrieve all news records from a remote Supabase table even though that capability is not clearly necessary for producing a single-file offline deliverable. When a skill’s implementation materially exceeds its stated purpose, it creates security risk through hidden data persistence, broader attack surface, and possible leakage of sensitive or proprietary news-analysis outputs to third-party infrastructure.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The trigger list contains broad phrases like producing maps, trend panels, or auto-filling news, which can cause the skill to activate in loosely related everyday contexts. Unintended activation is risky here because the skill may initiate searches, process local files, and generate outputs without the user specifically intending to invoke this workflow.

Unpinned Dependencies

Low

Category: Supply Chain
Content: # 核心依赖（build.py / pipeline.py 必需） openpyxl>=3.1 # 可选依赖（仅在使用 pull / push 同步 Supabase 时需要） # supabase>=2.0
Confidence: 87% confidence
Finding: Using an unpinned dependency range such as openpyxl>=3.1 can cause non-reproducible installs and may pull in newly released versions with incompatible changes or undiscovered vulnerabilities. In a supply-chain context, this increases exposure because builds may silently change over time without review.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: references/assets/echarts.min.js:45