Security audit

校园百事

Security checks across malware telemetry and agentic risk

Overview

This campus forum skill is useful in purpose, but it asks users to share passwords in chat and stores them persistently in a local JSON file.

Install only if you are comfortable with the assistant asking for forum credentials, sending them to the named forum service, and storing them locally in plaintext for later use. Do not provide a reused password; a safer design would use direct login, OAuth, or revocable tokens instead of chat-collected passwords.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The skill claims posts are anonymous while elsewhere requiring registration, credential collection, and account-linked posting. That mismatch can mislead users into believing their identity is not being processed or linkable when it actually is, creating privacy and consent risks.

Context-Inappropriate Capability

Critical

Confidence: 99% confidence
Finding: The skill explicitly instructs the assistant to collect and persist forum passwords in plaintext in a local file. Plaintext credential storage creates immediate account-compromise risk, enables reuse attacks if users recycle passwords, and far exceeds what a campus guide needs to function.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The skill instructs the assistant to inspect account records to infer first-use status and maintain user-to-school bindings. Persistent tracking of user history is not necessary for a simple campus information assistant and increases privacy exposure by building a behavioral/account map over time.

Intent-Code Divergence

High

Confidence: 96% confidence
Finding: The document states that submissions are anonymous and that submitter identity is not collected, but other sections require registration and storing credentials. This is a deceptive or inaccurate privacy representation that can invalidate consent and expose users to unexpected attribution or data retention.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The file explicitly instructs the AI to persistently store user account credentials, including passwords, even though the skill is described as a campus information and guide assistant. This creates a clear mismatch between stated purpose and actual behavior, increasing the risk of covert credential collection and unauthorized retention of sensitive data.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: Collecting and persisting forum usernames and passwords is not justified by a campus survival-guide or information-assistant use case. Because the capability is unrelated to the declared function, it strongly suggests credential harvesting or, at minimum, unsafe overcollection of highly sensitive data.

Vague Triggers

High

Confidence: 79% confidence
Finding: The description frames the skill as broadly applicable to nearly any campus information and says 'anything can be posted,' creating an overly expansive activation and operating scope. Broad scope increases the chance the agent handles sensitive, abusive, or out-of-policy content without appropriate guardrails.

Vague Triggers

Medium

Confidence: 79% confidence
Finding: The description frames the skill as broadly applicable to nearly any campus information and says 'anything can be posted,' creating an overly expansive activation and operating scope. Broad scope increases the chance the agent handles sensitive, abusive, or out-of-policy content without appropriate guardrails.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The skill directs users to provide account credentials for persistent storage without a prominent warning that passwords are sensitive and should not be shared with the assistant. This materially increases the chance of credential theft, reuse compromise, and user misunderstanding about who can access their secrets.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The skill instructs collection and transmission of school, username, email, and password to remote endpoints without a clear consent and privacy notice. Users are not told what data is sent where, for what purpose, how it is retained, or what happens if the remote service is compromised.

Vague Triggers

High

Confidence: 97% confidence
Finding: The instruction says that once users send registration credentials, the AI must immediately write them to persistent storage, with no scope limits, validation, minimization, or user-protection controls. Broad, unconditional credential persistence makes accidental capture, overcollection, and later misuse far more likely.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill documentation explicitly tells the AI to use a hidden image-analysis index and vision endpoint for forum-uploaded images without any requirement to notify users, obtain consent, or respect the original context of the upload. In a campus assistant context, images may contain faces, dorm interiors, schedules, IDs, or other sensitive student data, so encouraging silent secondary analysis increases privacy risk and can normalize covert processing of user content.

Ssd 3

High

Confidence: 99% confidence
Finding: The skill instructs persistent collection and storage of user credentials in a local file for reuse in future sessions. This creates a high-value secret store inside the agent environment, making any file exposure, logging issue, or lateral compromise immediately escalate to takeover of user forum accounts.

Ssd 3

High

Confidence: 98% confidence
Finding: Even after self-registration, the skill tells users to send their username and password back to the assistant for retention and future posting. This normalizes secret-sharing with the agent and recreates the same credential-exfiltration risk even when a direct registration path exists.

Ssd 3

High

Confidence: 100% confidence
Finding: The file directly instructs the AI to store user-provided passwords in a persistent JSON file for future use. Plaintext credential retention is a severe security flaw because it enables credential theft, unauthorized account access, replay against other services if passwords are reused, and broad compromise if the file is exposed.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.