Security audit

工作伴侣｜四件小事判官

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed Chinese workday decision helper with optional search, image-card, and local rendering utilities, and I did not find hidden data access, persistence, or unsafe automatic actions.

Install if you want a Chinese-first helper for small workday decisions. Be aware that casual phrases may route into it on some hosts, and only run the bundled Python scripts when you intentionally want to validate, render, or package the skill locally.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 79% confidence
Finding: The skill declares no permissions, yet the analyzer detected file_read, file_write, and shell-capable behavior. That creates a transparency and sandboxing problem: users and reviewers cannot accurately assess what the skill may access or modify, and those capabilities could be abused to read local data, alter files, or run commands beyond the stated helper purpose.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: The documented purpose is a lightweight workday decision helper, but the detected behavior includes release packaging, repository validation, artifact scanning, and asset rendering. This mismatch is dangerous because hidden build/release and filesystem-oriented operations expand the attack surface substantially and make it easier to conceal unexpected data access or command execution under an innocuous user-facing description.

Vague Triggers

Medium

Confidence: 72% confidence
Finding: The trigger phrases are very broad everyday language, increasing the chance the skill activates in contexts where the user did not intend to invoke it. Unintended invocation can expose user context, cause confusing actions, and route unrelated conversations into a skill that may have broader capabilities than its description suggests.

Vague Triggers

Medium

Confidence: 70% confidence
Finding: Telling users they can 'just say a sentence casually' without constraining scope encourages activation from generic language. In a skill with possible hidden file/shell-related capabilities, broad casual invocation raises the risk of unnecessary context exposure and accidental execution paths.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The trigger phrases include very generic terms such as '来张图', '只要一张图', and '每阶段出图', which can match ordinary conversation rather than an intentional invocation of this specific skill. That can cause unintended routing into image-generation behavior, potentially exposing sanitized but still user-derived content to external tools or producing outputs the user did not request.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The default prompt auto-invokes the skill with a broad phrase ('今天全套，快点') and does not define clear boundaries for when the skill should activate or defer. This can cause over-triggering, unintended invocation, or the skill steering user interactions beyond the narrow intended use cases, especially because it asks for a full run of the companion workflow by default.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The public invocation examples use very common phrases such as '午饭吃什么', '今天烦', and '下班想逃', which can unintentionally trigger the skill during ordinary conversation or broad directory matching. In a discovery or routing system, this creates over-capture risk: users may be routed into this skill when they intended generic assistance, causing misleading responses, privacy overcollection through unnecessary follow-up questions, or bypass of more appropriate skills.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger guidance relies on very broad natural-language cues, which can cause the skill to activate outside its intended scope and intercept general conversation. In a decision-helper skill, this increases the chance of inappropriate routing, unexpected behavior, and user confusion, especially when phrases overlap with ordinary chat or unrelated requests.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: Multiple sections specify behavior after activation but do not clearly state the conditions under which each mode should be entered. That ambiguity can make the system over-apply these instructions to loosely related user inputs, leading to unintended data collection prompts, misclassification of user intent, or responses outside the advertised scope.

Natural-Language Policy Violations

Medium

Confidence: 88% confidence
Finding: The template is written to enforce Chinese-only interaction without offering language detection, user choice, or a fallback path. This can cause accessibility and consent issues, and in multilingual environments may lead to misunderstanding of instructions or collection of incorrect input from users who did not choose Chinese.

VirusTotal

44/44 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/package_release.py:32

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/validate_skill.py:76