Security audit

技能诊所

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed skill-development assistant whose file access, searches, and local feedback logs mostly fit its stated purpose.

Install only if you want an assistant that can read and edit skill files, inspect your local skill directory, run skill-marketplace searches, and keep local feedback logs. Avoid using it on sensitive private skills unless you are comfortable with local indexing, possible remote search queries, and local storage of error context.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The metadata.trigger list is very broad and includes generic phrases such as 体检、诊断、评估、反馈 and English terms like 'skill clinic'. In systems that auto-route by trigger matching, this can cause the skill to activate outside its intended scope, letting it read/write files or invoke Bash in unrelated conversations and increasing the chance of prompt-scope hijacking or unintended tool execution.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The module trigger table uses short, ambiguous activators like 创建、设计、反馈、类似、验证 that commonly appear in ordinary requests. If the agent uses these to select workflow branches, an attacker or an unrelated user query can accidentally or deliberately steer execution into file modification, search, or gate-check flows without clear intent, expanding the attack surface.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The example instructs performing a remote search via 'npx skills find "code review"' without any notice that this may initiate network access and disclose search terms or related context to an external service. In a skill-discovery workflow, users may reasonably expect local analysis only, so silent outbound activity can leak proprietary project interests, internal terminology, or other sensitive metadata.

Vague Triggers

Medium

Confidence: 75% confidence
Finding: The natural-language trigger phrase “有没有类似技能” is broad and conversational, making unintended activation more likely during ordinary discussion. In this skill, unintended activation matters because it can initiate local enumeration of installed skills and remote lookups, creating unnecessary command execution and possible privacy leakage.

Vague Triggers

Low

Confidence: 75% confidence
Finding: The natural-language trigger phrase “有没有类似技能” is broad and conversational, making unintended activation more likely during ordinary discussion. In this skill, unintended activation matters because it can initiate local enumeration of installed skills and remote lookups, creating unnecessary command execution and possible privacy leakage.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The module explicitly states that execution errors and score changes are automatically recorded, but it provides no notice, consent, minimization, or retention guidance for that captured data. Error context can easily contain sensitive user inputs, URLs, tokens, prompts, or operational metadata, so silent collection and storage in a feedback log creates a privacy and compliance risk even if the feature is intended for observability.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.