Lp3
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
- Without declared permissions the skill's intent is opaque and cannot be validated.
Security audit
text2echart
Security checks across malware telemetry and agentic risk
Overview
This appears to be a normal chart-making tool, with some documentation and privacy caveats but no hidden data access or destructive behavior found.
Install only if you want a local ECharts chart generator. Avoid putting confidential data in generated HTML that will be opened with the default CDN mode; use --embed/offline mode for sensitive charts. Expect some rough edges in the docs: --open may not actually launch a browser, and some advertised chart types are broader than the CLI’s CSV conversion support.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (45)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
- This is a mismatch because several declared behaviors are not actually implemented as described. The core chart-generation purpose is broadly accurate: the code builds ECharts HTML from JSON/CSV and supports SVG and screenshot export, including wordcloud support. However, the description materially overstates features: `--open` does not open a browser for interactive adjustment, there is no implemented mermaid-based rendering, and scatter is listed as a supported chart type but is absent from the CLI's supported CSV `--type` values and conversion logic. These are not minor implementation details; they are user-visible capability claims that the code does not fulfill.
Intent-Code Divergence
Medium
- Confidence
- 94% confidence
- Finding
- The inline documentation at L014-L017 states the model will never auto-invoke the skill and that explicit user invocation ensures conscious human oversight. L089 then claims the skill 'automatically routes requests to chart generation,' which directly contradicts that stated invocation model and user-consent expectation.
Description-Behavior Mismatch
Medium
- Confidence
- 97% confidence
- Finding
- The manifest description limits the skill to 6 chart types: bar, line, pie, scatter, radar, and wordcloud. The README expands actual capability to 'any ECharts series type' and enumerates many additional chart families and components, including map and 3D chart support, which materially exceeds the manifest's described scope.
Description-Behavior Mismatch
Medium
- Confidence
- 94% confidence
- Finding
- The manifest description at L006-L011 claims support for 6 chart types: bar, line, pie, scatter, radar, and wordcloud. However, the documentation later states that the underlying skill can generate many additional ECharts series types and extensions, including maps, 3D charts, custom renderers, and animation/timeline capabilities, materially broadening the advertised behavior beyond the declared scope.
Description-Behavior Mismatch
Low
- Confidence
- 77% confidence
- Finding
- The manifest frames the skill primarily as constructing ECharts option JSON and outputting an HTML string directly, with image/vector/screenshot/fine-tuning as specific triggered cases. The document expands this into a more general CLI-driven local generation workflow including saving files and opening browsers, which is somewhat broader than a simple chat-output chart generator and changes the operational model from in-chat rendering to local execution workflows.
Intent-Code Divergence
Medium
- Confidence
- 88% confidence
- Finding
- The 'When to Use / When Not to Use' section says 'Animate this chart frame by frame' is not a fit and that real-time streaming data should use ECharts directly. Later, the 'Other Advanced Capabilities' section claims support for timeline and animated effect types such as EffectScatter and related advanced features, creating an intent-level contradiction about animation-oriented use cases.
Intent-Code Divergence
Medium
- Confidence
- 95% confidence
- Finding
- The placeholder text for 'Variable Assignment' says inputs are 'pure JSON (no code execution)', but the instructions later explicitly allow references like '${publicVar.x * 2}', which requires evaluating expressions rather than treating input as inert JSON only. This is an intent-level contradiction in the file's own user-facing documentation about whether executable/evaluated logic is involved.
Description-Behavior Mismatch
Low
- Confidence
- 90% confidence
- Finding
- The manifest says the skill supports 6 chart types: bar, line, pie, scatter, radar, and wordcloud. However, the footer advertises many additional chart families such as candlestick, box plots, maps, heatmaps, treemap, sunburst, funnel, gauges, and mixed compositions, indicating a broader claimed capability than the manifest describes.
Vague Triggers
Medium
- Confidence
- 98% confidence
- Finding
- The README lists broad invocation keywords such as "chart", "graph", "visualize", "plot", and especially "draw" plus "etc." without clear constraints or negative examples. In a markdown file, this creates ambiguous trigger scope and increases the chance of unintended invocation from normal conversation.
Missing User Warnings
Medium
- Confidence
- 89% confidence
- Finding
- The markdown explicitly says the skill renders executable HTML content, and later states it generates HTML directly in chat by default. Although this acknowledges the behavior, it does not give a concrete user-facing warning about reviewing generated HTML before opening or rendering it, which is relevant to user safety and system integrity.
Vague Triggers
Medium
- Confidence
- 95% confidence
- Finding
- The listed trigger words include generic terms such as "chart", "graph", "visualize", "plot", "draw", and especially "图片"/"picture", which can appear in many ordinary user requests outside this skill's intended scope. Because the manifest exposes these as activation keywords without narrow context or exclusion examples, the skill could be invoked unintentionally.
Vague Triggers
Medium
- Confidence
- 88% confidence
- Finding
- The routing section uses broad case conditions like "user asks for a chart / graph / visualization" and "image / picture / vector graphic" without clear precedence or exclusion rules between routes. This makes it unclear when the default HTML route should apply versus image, screenshot, or local-file routes, increasing the chance of inconsistent or unintended invocation behavior.
Missing User Warnings
Medium
- Confidence
- 89% confidence
- Finding
- The default HTML output includes external script tags from jsDelivr, and the generated page embeds the user's chart data in JavaScript. When that HTML is opened, the browser will contact third-party CDNs as part of rendering, but the code does not provide any warning at generation time beyond the option list. This is a code-file warning issue because network behavior affecting user data/privacy is present without a clear user-facing disclosure.
Natural-Language Policy Violations
Low
- Confidence
- 81% confidence
- Finding
- SQP-3 applies to all file types and covers language or locale policy violations. This file repeatedly directs readers to Chinese-language documentation and uses Chinese-only field explanations in the option reference, but does not state that users may choose another language or that the Chinese locale is required for a region-specific use case.
Natural-Language Policy Violations
Low
- Confidence
- 94% confidence
- Finding
- This markdown file presents the skill content entirely in Chinese, including the title and property descriptions, with no indication that users may choose another language. The policy explicitly flags forced language or locale behavior when there is no user opt-in or documented justification.
Natural-Language Policy Violations
Low
- Confidence
- 87% confidence
- Finding
- The file content and title are entirely in Chinese and provide no indication that language selection is optional or configurable. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.
Natural-Language Policy Violations
Medium
- Confidence
- 91% confidence
- Finding
- The file is entirely written in Chinese and is labeled with a `-zh-` path/source variant, which indicates a fixed language choice. There is no indication that users can choose another language or that the locale restriction is required for a region-specific purpose, which conflicts with the language/locale policy criterion.
Natural-Language Policy Violations
Low
- Confidence
- 95% confidence
- Finding
- The file is entirely written in Chinese, including the title, description, and examples, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.
Natural-Language Policy Violations
Low
- Confidence
- 91% confidence
- Finding
- The document title, descriptive text, and source path all indicate the skill content is provided only in Chinese (`zh`) without any note that the user can choose another language. This can violate a language/locale policy when a skill forces a specific language without user opt-in.
Natural-Language Policy Violations
Medium
- Confidence
- 91% confidence
- Finding
- The file is entirely presented in Chinese, including the title, description, and field explanations, with no indication that the language choice is optional or that the skill is restricted to a Chinese-language context. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation.
Natural-Language Policy Violations
Low
- Confidence
- 90% confidence
- Finding
- The code automatically derives the interface language from document.documentElement.lang and later toggles only between 'en' and 'zh'. This imposes a locale choice based on environment settings rather than explicit user opt-in, which matches the language/locale policy concern.
Natural-Language Policy Violations
Low
- Confidence
- 83% confidence
- Finding
- This JavaScript file contains hard-coded Chinese chart titles and labels such as "1-12月水果销售统计" and "单位：吨". The skill does not indicate any user choice or opt-in for language/locale, which can violate a policy requiring language selection rather than forcing a specific locale.
Natural-Language Policy Violations
Low
- Confidence
- 79% confidence
- Finding
- The x-axis month labels are entirely hard-coded in Chinese (e.g. "1月" through "12月") with no indication that the user can choose another language. This suggests the skill enforces a specific locale in its user-facing output.
Natural-Language Policy Violations
Low
- Confidence
- 80% confidence
- Finding
- The line-chart template includes Chinese labels such as "温度变化趋势", "最高气温", "最低气温", and weekday names. Without any language-selection logic or documented locale restriction, this appears to force a specific language.
VirusTotal
63/63 vendors flagged this skill as clean.
Static analysis
Detected: suspicious.dynamic_code_execution
Dynamic code execution detected.
Critical
- Code
- suspicious.dynamic_code_execution
- Location
- lib/echarts-5.6.min.js:45