Security audit

zero-one-two-three知识变现架构师

Security checks across malware telemetry and agentic risk

Overview

The skill mostly matches its knowledge-management purpose, but it needs Review because some commands can process email, send outbound mail, and persist local file data more broadly than users may expect.

Install only after reviewing the mailbox behavior. Use a dedicated mailbox and app-specific password, avoid running --report on a live mailbox until the report/process-mail coupling is fixed, limit scans to specific non-sensitive folders, do not pass secrets on the command line, and avoid sending confidential text through the TTS feature.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (19)

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The documented '--report' mode implies a reporting-only action, but the main flow continues into IMAP processing and may automatically fulfill unread emails. In a mailbox automation tool, this hidden side effect can trigger unintended outbound deliveries and business actions when an operator expected only telemetry/reporting behavior.

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The CLI help claims '--report' only sends an experience report, but execution also processes unread inbox messages and can send delivery emails. This discrepancy is dangerous because operators may invoke a seemingly harmless command and unknowingly trigger customer-facing actions and state changes in the mailbox.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The module advertises 'voice cloning' and speaking in the user's own style/voice, but the implementation only chooses from a fixed Edge TTS voice set and applies simple rate/pitch adjustments from a JSON profile. This is a deceptive capability claim that can mislead users into believing biometric voice cloning is occurring, which is dangerous in a security-sensitive context because it obscures what data is actually used and what the system can really do.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The README promotes style cloning and voice cloning without any mention of consent, identity misuse, or privacy safeguards. In an agent skill context, documentation shapes user behavior; omitting these warnings can normalize impersonation or non-consensual biometric processing and materially increases abuse risk.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The README advertises an ephemeral-sharing feature for confidential files as if it provides strong secrecy, but gives no warning that 'burn after reading' mechanisms often leave residual copies in logs, caches, screenshots, or recipient systems. This can mislead users into sharing sensitive material under a false sense of safety.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The README instructs users to store email and Notion credentials in environment variables without any secret-handling guidance, rotation advice, or least-privilege recommendations. While environment variables are common, presenting raw credential setup without safety notes can lead to overexposure through shell history, process inspection, screenshots, or use of overly privileged long-lived tokens.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The README advertises style cloning and voice cloning features but does not provide clear consent, privacy, impersonation, or misuse warnings. Even though this is documentation rather than executable code, normalizing these capabilities without guardrails can facilitate unauthorized replication of a person's writing style or voice for fraud, deception, harassment, or privacy violations.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger phrase is extremely broad and phrased like normal user language, which increases the chance of accidental activation. In a skill that can sync knowledge bases, process attachments, and initiate workflows, unintended invocation could cause unexpected data access or actions the user did not mean to authorize.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: Using any user-entered keyword such as '减肥' as a trigger for zero-base modeling is overly broad and ambiguous. This makes accidental or contextually inappropriate activation likely, potentially causing the skill to run substantial processing or produce outputs without clear user intent.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The skill states that after configuration it will automatically send an experience report to the configured email address, but does not present this as a clear opt-in action with informed consent. Automatic transmission of generated content tied to setup activity creates a real risk of unintended disclosure of personal, configuration, or usage-related information.

Missing User Warnings

High

Confidence: 96% confidence
Finding: Describing mailbox monitoring, attachment parsing, and automatic classification without a strong privacy warning or explicit consent mechanism is dangerous because it implies ongoing access to potentially sensitive email content. In context, the skill can ingest attachments and correlate them with other knowledge sources, which increases the risk of exposing private documents or over-collecting user data.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: Accepting the access key via a command-line argument can expose the secret through shell history, process listings, job control logs, and monitoring tools. Because this tool is specifically designed to protect confidential shared content, leaking the decryption key defeats the confidentiality model and may allow unauthorized access.

Missing User Warnings

Medium

Confidence: 99% confidence
Finding: Passing encryption passwords on the command line exposes secrets to local process inspection, shell history, audit logs, and system monitoring tools. Because this tool handles confidential note encryption, leaking the password can directly compromise all protected content despite the use of Fernet.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The script automatically emails an external recipient with system metadata and account/business information without an explicit just-in-time warning or consent gate. In this skill context, that creates a real exfiltration path from the operator environment to the author-controlled address via AUTHOR_EMAIL.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The scan workflow reads local Markdown/text files, stores absolute source paths, and persists content previews into a catalog file without any consent prompt, redaction, or scope restriction. In an agent/skill context, this can silently inventory sensitive local notes and leak filesystem structure or partial document contents into durable storage that may later be exported or accessed by other components.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The tool recursively reads files and directories supplied by the user, including .md, .txt, and .py content, and concatenates them into a style corpus. In a skill/agent context, this can unintentionally ingest sensitive local material such as private notes, chat logs, credentials embedded in source files, or proprietary code without a clear consent boundary or preview of what will be read.

Missing User Warnings

Low

Confidence: 81% confidence
Finding: The skill writes derived artifacts (JSON fingerprint and optional HTML report) to local disk based on analyzed user text, but does not clearly warn that persistent files will be created. These outputs may themselves contain sensitive stylistic and textual inferences, so silent creation can leave privacy-sensitive data behind on shared systems or in synced folders.

Ssd 3

Medium

Confidence: 95% confidence
Finding: Automatically emailing generated experience reports creates a natural-language exfiltration path because setup details, user feedback, or environment-specific information may be transmitted outside the local environment. Even if the configured address is user-controlled, the behavior is risky when it occurs automatically and without a clear approval step.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The generated report includes the operator's mailbox address, mail provider, operating system, Python version, and business metrics, and sends them to an external address. In the context of an automation skill handling commercial mailbox workflows, this is sensitive operational data disclosure and can aid profiling, targeting, or unauthorized business intelligence collection.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: ephemeral_share.py:87