Security audit

众安车险自助投保

Security checks across malware telemetry and agentic risk

Overview

This car-insurance skill is purpose-aligned, but it handles payment, identity data, local consent records, and API credentials in ways users should review before installing.

Review this skill before installation. It is not clearly malicious, but it can send personal data to insurance APIs, open payment pages, store your phone number locally, and expose sensitive request data or API credentials through logs and URLs. Install only if you trust the publisher and are comfortable with those data-handling choices.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill explicitly requires Bash and shell-based API calls, file writes, and local state checks, yet no declared permissions are present. This creates a hidden capability gap where the runtime may execute sensitive local and network actions that users and platform policy do not clearly authorize.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The skill instructs the agent to persist phone numbers in a local file under ~/.car_insurance_auth, even though phone numbers are personal data and later sections say sensitive data should not be written to files. This creates unnecessary local retention, expands exposure to other local users/processes, and weakens consent/audit guarantees because the file is unmanaged, unencrypted, and outside a controlled backend authorization system.

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: The file contains a direct policy contradiction: one rule says phone numbers and similar sensitive data must not be written to any file, while the authorization workflow explicitly requires appending the phone number to a local authorization file. Contradictory security requirements cause unsafe implementations, bypasses, and inconsistent handling of regulated personal data, especially in an insurance context where agents may follow the less secure branch.

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: The document claims session data should not be persisted and should be reloaded from environment variables each session, yet cancellation and authorization logic depend on a persistent local file. This inconsistency increases the chance of stale authorization state, incomplete revocation, and privacy failures where a user believes consent was withdrawn but residual local records still affect future behavior.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The skill explicitly instructs appending `car-api-key` to a browser-opened payment-page URL query string. Query parameters are commonly exposed via browser history, logs, analytics, screenshots, referrers, and intermediary systems, so this leaks a credential beyond its intended server-to-server scope. In a payment/insurance workflow, exposing an API key can enable unauthorized API access or replay against related endpoints.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill description advertises a flow that collects a phone number, sends SMS codes, and writes an authorization record, but it does not clearly warn users up front about these side effects. Because the skill is designed to auto-progress between steps, users may be nudged into sensitive actions without adequately informed consent.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The workflow mandates opening a payment QR page and driving the user toward payment completion without a clear prior warning about browser navigation, payment initiation, and data sharing with an insurer. In a financial transaction context, that omission raises phishing-like UX risk and reduces the user's ability to make an informed decision.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill stores authorization records tied to a user's phone number in a local file, but the skill description does not clearly disclose this retention behavior to the user. In a car-insurance workflow, silent local storage of personal identifiers undermines informed consent and can violate privacy expectations or compliance requirements if users are not told what is stored and for how long.

Missing User Warnings

Low

Confidence: 76% confidence
Finding: The skill directs the agent to automatically open multiple external agreement pages before clearly warning the user that a browser launch will occur. While likely intended to streamline consent, automatic navigation to external sites can surprise users, create trust confusion, and in some agent environments could be abused to trigger unwanted browser activity without explicit opt-in.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill instructs collecting and transmitting highly sensitive personal data, including a full name and national ID number, to backend quote APIs without requiring any explicit user-facing privacy notice, purpose statement, retention disclosure, or consent language beyond generic authorization flow context. In an insurance workflow this materially increases the risk of over-collection, uninformed disclosure, and misuse of identity data if the agent follows the instructions verbatim.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The OCR flow directs users to upload driver's-license images and sends them to backend OCR services, then uses extracted document fields in downstream quoting, but it does not require an upfront warning that document images and derived personal data will be processed by backend systems. Because license images contain multiple sensitive identifiers, lack of explicit disclosure and consent makes accidental oversharing and privacy harm more likely in this skill context.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The script prints the full JSON request body to stderr before sending it, and the documented use cases include highly sensitive personal data such as vehicle number, owner name, phone number context, and certificate/ID numbers. In CI logs, terminal scrollback, shell history captures, or agent execution logs, this can expose regulated personal data to unintended parties.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: Allowing the API key to be passed as a positional command-line argument increases the chance that the secret is exposed through process listings, shell history, agent telemetry, or job logs. While the script also supports an environment variable, documenting and encouraging argv-based secret passing is an avoidable credential-handling weakness.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: auth.md:113