Security audit

Privora · 实时监控 · 黄金实时监控 / 基金净值监控 / 股价预警 · 越线飞书/微信 Webhook · AI Agent

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly a legitimate alert-monitoring workflow, but it ships generic bearer-token gateway scripts that can enumerate and call broader Privora capabilities than the stated 20 alerting operations.

Install only if you are comfortable giving this package a Privora bearer token and if that token is limited to the realtime-alerting preset. Do not reuse a broadly scoped Privora token; the included scripts can discover visible skills and send arbitrary skill execution requests, so token scope is the main safety boundary.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill explicitly instructs use of shell wrappers such as `scripts/lg_agent_exec.sh` and requires sensitive environment variables (`LG_AGENT_BASE_URL`, `LG_AGENT_TOKEN`), yet it declares no corresponding permissions boundary. That creates a capability mismatch where an agent may invoke shell-based execution and networked actions without transparent least-privilege disclosure, increasing the risk of unintended command execution or secret misuse.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documented behavior is materially broader than the claimed purpose: the skill can enumerate visible skills, inspect arbitrary schemas, and execute any specified `skillId` through a generic `/agent/skills/execute` gateway with arbitrary JSON bodies. This turns a supposedly focused alerting skill into a general-purpose capability broker, enabling privilege expansion, unexpected side effects, and abuse of the bearer token beyond the user’s monitoring intent.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The script documentation explicitly states that it lists every skill visible to the bearer token and explains that visibility is broader than granted execution scope. For a skill whose stated purpose is asset monitoring, embedding generic discovery guidance expands the attacker's reconnaissance surface by helping enumerate unrelated capabilities and their required scopes.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The implementation performs unrestricted GET requests to /agent/skills and /agent/skills?skillId=<id>, enabling enumeration of all visible skills and schema discovery for arbitrary skill IDs. Even if execution authorization is still enforced server-side, exposing broad capability metadata materially assists attackers in mapping the environment and identifying higher-value targets or callable operations.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The wrapper is explicitly described as a generic 'Agent Skill Gateway discovery' tool with commands to list every visible skill and describe any chosen skill. That capability is not justified by the manifest's narrow monitoring use case, so in context it increases danger by normalizing arbitrary reconnaissance inside a package that users may trust as only handling market-alert workflows.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.