Gangtise 文件列表

• Outcome: Pass
• Latest audit: May 29, 2026 · 8:45 PM UTC
• Version: 1.4.12

Overview

This skill is a coherent Gangtise document search and download helper, but users should understand it sends queries and credentials to Gangtise and can write downloaded or saved results locally.

Install only if you trust Gangtise with the configured access credentials and the search terms you submit. Expect files and some usage/result data to be saved under a local Gangtise workspace when downloading or enabling save behavior, and avoid using automatic download or result saving in shared or regulated workspaces without a cleanup plan.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill requires environment credentials, reads configuration files, writes downloaded files locally, and performs network access, yet it does not declare corresponding permissions. This creates a transparency and governance gap: operators and users cannot accurately assess the skill’s runtime capabilities, which increases the risk of unintended secret exposure, unreviewed data egress, or unexpected filesystem modification.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The documented behavior materially differs from the skill metadata: instead of file-center document retrieval and download assistance, it describes a separate 'chief opinions' search interface. This can cause the agent to invoke the wrong capability, omit expected file-handling safeguards, and produce misleading or incomplete results in workflows that rely on accurate tool semantics.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The reference explicitly states that the interface does not include file download, directly contradicting the manifest's promise to provide download assistance by type and ID. In an agent setting, this mismatch is dangerous because downstream planning may assume download capability exists, leading to failed tasks, unsafe fallback behavior, or incorrect claims about evidence retrieval and verification.

Context-Inappropriate Capability

Low

• Confidence: 94% confidence
• Finding: The code prints `report.get('titleTranslate')` directly to stdout during normal formatting, which leaks provider-returned content outside the intended structured response channel. In an agent/tooling context, stdout is often captured in logs, traces, or operator consoles, so translated report content may be exposed unexpectedly.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The implementation materially diverges from the advertised skill purpose: it performs investment calendar/event retrieval rather than file-center document search and download. This kind of capability mismatch is dangerous because downstream agents or users may rely on the manifest to make trust and data-handling decisions, causing unintended queries, incorrect business workflows, or misuse of privileged access under false pretenses.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The returned payload is explicitly structured as calendar results (`module: calendar`, `type: files`, calendar-specific messages) rather than file-center search output. Schema/semantic mismatch can cause consuming agents to mis-handle results, misroute subsequent download actions, or present misleading data to users, which is a security and integrity concern in tool-using systems.

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: The utility persists usage telemetry and potentially full query results to local files even though the skill description is primarily about retrieval and filtering. In an agent environment, silent persistence can expose sensitive research queries, downloaded content, and access patterns to other local processes or later users of the workspace.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The skill documents an option to automatically download files to local storage but does not clearly warn that this causes filesystem writes and may persist potentially sensitive or licensed documents. Users may invoke download behavior without understanding retention, overwrite, or data handling consequences, especially in shared or regulated environments.

Missing User Warnings

Low

• Confidence: 91% confidence
• Finding: The dedicated download section instructs how to retrieve complete files to local storage but omits basic safety/privacy guidance. Full documents can contain sensitive research, announcements, or meeting materials, so silent persistence to disk increases the risk of unauthorized retention, accidental sharing, or policy violations.

Missing User Warnings

Medium

• Confidence: 81% confidence
• Finding: The function transmits user-supplied query parameters, potentially including keywords, securities, institutions, concepts, and analyst identifiers, to an external backend via HTTP without any disclosure or consent mechanism in this file. In an agent setting, this can surprise users and expose sensitive research intent or proprietary search terms to a remote service.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The code reads `accessKey` and `secretAccessKey` from environment variables or a local file and sends them to a remote endpoint to obtain a token, without any user-facing disclosure in this module. In a skill setting, hidden credential transmission is sensitive because users may not expect local secrets to be automatically exfiltrated to an external service during initialization.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The code writes usage data and query results to local files without any in-function warning or consent flow. In this skill context, retrieved documents, summaries, and usage logs may contain commercially sensitive or user-sensitive information, so silent persistence increases confidentiality and data-retention risk.

Ssd 3

Low

• Confidence: 95% confidence
• Finding: The raw translated title is emitted to stdout independently of the returned API payload, creating an unintended side channel for third-party content. Because this skill handles external report data, such leakage can disclose sensitive or licensed content to logs or downstream monitoring systems.

External Transmission

Medium

• Category: Data Exfiltration

Content

if keyword:
            data["keyword"] = keyword

        response = requests.post(OPINION_URL, headers=headers, json=data)
        if response.status_code != 200:
            if all_results:
                return all_results, response.text.replace("\n", " ").replace("\r", " ").strip()

• Confidence: 84% confidence
• Finding: requests.post(OPINION_URL, headers=headers, json=

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.