Security audit

AI懂帮我巧匠

Security checks across malware telemetry and agentic risk

Overview

The skill is not clearly malicious, but it needs review because it encourages creating plain local files containing personal memories and secrets while making overly broad privacy promises.

Review before installing. Use it only if you are comfortable having your work details, preferences, memories, and possibly confidential notes consolidated into local Markdown or Word files. Do not put passwords, API keys, credentials, private client data, or other real secrets into SECRET.md; redact sensitive values and delete generated files when no longer needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The skill repeatedly assures users that nothing is stored and that data exists only on their device, yet later directs creation of multiple persistent files and documents containing user details. This is dangerous because it misrepresents data handling, undermines informed consent, and can cause users to disclose sensitive information they would not otherwise share.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The skill’s stated purpose is lightweight onboarding and personalization, but it expands into collecting and organizing highly sensitive categories such as long-term memory, user profiles, tool history, and secrets. That scope expansion is risky because it gathers more sensitive data than is necessary for the declared purpose, increasing exposure if mishandled or leaked.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: Instructing the agent to create a dedicated SECRET.md file normalizes collecting and storing reusable sensitive information in a plainly labeled artifact. This is dangerous because it concentrates secrets into an easily discoverable document, increasing the chance of accidental exposure, exfiltration, or inappropriate reuse beyond the original user intent.

Context-Inappropriate Capability

Medium

Confidence: 81% confidence
Finding: The skill directs invocation of a local Python script to generate Word documents even though its purpose is conversational profiling and document drafting. This adds an unnecessary code-execution step that expands the attack surface, especially if document content is passed to scripts, shell commands, or file paths without strict validation.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: Broad trigger phrases can cause the skill to activate during ordinary conversation and begin eliciting personal or sensitive profiling data without sufficiently clear user intent. In this context, unintended activation is more dangerous because the skill collects structured personal preferences, work details, and potentially sensitive memory-like information.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: Colloquial and weakly scoped triggers increase the likelihood of accidental invocation. Because this skill’s workflow quickly transitions into profiling and persistence-oriented outputs, unintended activation can lead to oversharing or collection of data the user did not mean to provide to this skill.

Ssd 3

High

Confidence: 98% confidence
Finding: The skill explicitly instructs the agent to compile sensitive user memory, behavioral history, tools usage, and secrets into dedicated files in plain language. This is dangerous because it transforms scattered sensitive context into portable, readable records that are easier to access, copy, leak, or misuse.

Ssd 3

High

Confidence: 99% confidence
Finding: The '搜魂大法' flow is designed to reveal accumulated memories, user understanding, tool experience, and 'little secrets' as a packaged archive. In context, that makes the skill especially dangerous because it operationalizes bulk extraction of sensitive profile data under a friendly framing, which could normalize oversharing and increase exposure risk.

Ssd 3

Medium

Confidence: 92% confidence
Finding: The output templates and contract normalize persistent recording of user identity, work details, feedback patterns, tasks, and sensitive information into reusable documents. This is risky because standardizing storage of such data encourages overcollection and long-lived retention without clear minimization, retention limits, or access controls.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.