Barcode Generation And Recognition - 条码生成识别

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:19 PM UTC
• Version:
  1.0.3

Overview

This skill appears to do only barcode generation and recognition through JisuAPI, with expected API-key and barcode-data sharing for that purpose.

Install this only if you are comfortable using a JisuAPI AppKey and sending barcode values, barcode image URLs, or base64 barcode images to JisuAPI for processing. Treat JISU_API_KEY as a secret, avoid committing or logging it, and avoid submitting sensitive internal labels or regulated data unless JisuAPI's privacy and retention terms are acceptable.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill metadata declares runtime requirements for an environment variable and implies network access to a third-party API, but it does not explicitly declare permissions or warn users about those capabilities. This creates a transparency and governance gap: users or platforms may invoke the skill without realizing it can exfiltrate user-provided barcode content and use a secret API key.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger description uses broad language such as 'or similar barcode generation/recognition,' which can cause the agent to invoke the skill for loosely related requests. Overbroad invocation increases the chance of unintended third-party data transmission or processing without clear user intent.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation states that barcode image URLs or base64 image data are sent to a third-party recognition service, but it does not clearly disclose this external transfer to users. If users provide proprietary product labels, internal inventory barcodes, or other sensitive images, their data may be transmitted off-platform without informed consent.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The skill instructs operators to set JISU_API_KEY but does not warn that the key is a secret that must not be hardcoded, logged, or committed to source control. This omission increases the likelihood of accidental credential exposure, which could lead to unauthorized API use and billing or quota abuse.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill sends user-supplied barcode content, which may be an image URL or base64-encoded image, to a third-party service for recognition without any in-code notice or consent checkpoint. This creates a privacy and data-handling risk because user-provided images or embedded metadata may be transmitted off-platform unexpectedly.

VirusTotal

65/65 vendors flagged this skill as clean.