Security audit

MacCheck

Security checks across malware telemetry and agentic risk

Overview

This Mac inspection skill is local and purpose-aligned, but users should treat its generated reports as sensitive because they include device identifiers and security status.

Install only if you intend to run a local Mac inspection. Review and protect the output directory and downloaded reports because they can include the full serial number, OS/build, storage, MDM/ADE, FileVault, SIP, Activation Lock, network, and peripheral details. Camera, microphone, USB, and file-picker prompts should only be approved when you are actively running those specific hardware tests.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The skill description explicitly claims '不联网' (no networking), but the UI renders a button linking to https://checkcoverage.apple.com/. Even if the network access is user-initiated, this contradicts the advertised privacy boundary and can mislead users into sending device-related information to an external site they did not expect to contact.

Scope Creep

High

Confidence: 98% confidence
Finding: The microphone test calls navigator.mediaDevices.getUserMedia({audio:true}) and records audio with MediaRecorder, which exceeds a 'read-only' permission claim. This captures sensitive user audio and creates a retained recording blob in the page, so users relying on the manifest/privacy description may grant far more access than intended.

Scope Creep

High

Confidence: 98% confidence
Finding: The camera test requests live video access via getUserMedia({video:true}) despite the skill claiming only read-only permissions. Camera access is privacy-sensitive, and the mismatch between stated permissions and actual behavior can cause users to expose visual surroundings or themselves under false assumptions.

Scope Creep

High

Confidence: 95% confidence
Finding: The port test invokes navigator.usb.requestDevice({filters:[]}), which requests user-mediated access to attached USB devices and is broader than a 'read-only' claim suggests. Requesting unrestricted device selection can expose connected hardware metadata and grant the application capabilities beyond passive inspection.

Scope Creep

High

Confidence: 94% confidence
Finding: The storage/port test uses window.showOpenFilePicker(), which prompts the user to grant access to filesystem objects, conflicting with a 'read-only permissions only' representation. Even limited picker-based access changes the trust model because the skill can obtain file handles and interact with user-selected content.

Scope Creep

Medium

Confidence: 97% confidence
Finding: The script defines a write primitive and later uses it to persist normalized results to disk, which conflicts with the skill description's claim of read-only behavior. Because the output contains sensitive local device facts such as serial number, security posture, storage details, and network state, this creates an integrity and privacy gap between declared and actual behavior.

Scope Creep

Medium

Confidence: 99% confidence
Finding: At this line the script writes facts.json to the session directory, materially exceeding a read-only trust boundary if the manifest/description promises no modification. The risk is heightened because the file aggregates sensitive identifiers and security metadata into a convenient single artifact that can persist after execution.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The documented trigger phrase "Check this Mac for me" is broad enough to overlap with ordinary user requests and can cause the skill to activate in contexts where the user did not explicitly intend to invoke this specific capability. Because the skill gathers extensive device, system, network, storage, and security information, unintended activation increases privacy and overreach risk even if the checks are described as local and read-only.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The README suggests invoking the skill with a very generic natural-language phrase, '帮我检查这台 Mac。', which overlaps with ordinary user speech and could cause unintended activation in agents that use loose matching or prompt-based routing. Because this skill performs broad local system inspection and opens local pages, accidental invocation could expose sensitive device information or trigger actions the user did not specifically intend.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The skill can be triggered by broad, everyday phrases such as general device-check or acceptance-check language, which increases the chance of accidental or overly eager invocation. Because invoking this skill launches a full local system inspection and opens a local page, ambiguous triggering can cause unnecessary collection/display of sensitive device information without sufficiently explicit user intent.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The microphone flow starts audio capture after the user presses record, but the code shows no clear pre-capture warning explaining that audio will be recorded, stored locally as a blob, and playable afterward. In a device-inspection skill marketed as local/read-only, insufficient notice increases the risk of surprise collection of sensitive speech or ambient audio.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The camera preview function requests video access without a strong user-facing warning about what will be captured and that a live preview will open. Because the skill is framed as a local verification tool, the missing disclosure can mislead users about the sensitivity and immediacy of camera activation.

Natural-Language Policy Violations

Low

Confidence: 92% confidence
Finding: The schema explicitly includes both `serialNumber` and `serialMasked`, which permits collection and downstream handling of a full device serial number. Even in a local/read-only Mac inspection skill, a raw serial is sensitive asset-identifying data that can enable device tracking, inventory correlation, warranty lookup, or accidental disclosure if reports are exported or shared.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: This script collects detailed system inventory and security-status data, including hardware identifiers, battery details, storage layout, Wi‑Fi/Bluetooth state, FileVault status, SIP status, and enrollment/profile status, then writes the results into a session directory on disk. In the context of a local Mac inspection tool this collection is expected, but it still creates a privacy and security exposure if the session directory is readable by other local users, retained longer than necessary, or later exported/shared without clear user consent.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The generated facts.json includes sensitive device data including serial number, OS/build, MDM/ADE, FileVault, SIP, Activation Lock, storage, and network status, but this file-level code offers no disclosure, minimization, or retention controls. Persisting a consolidated local inventory artifact increases privacy exposure and makes later exfiltration by other local processes easier.

VirusTotal

50/50 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.