Security audit

List · 智能表单（智能记账·智能记事本·智能账单）- Smart Form & Notes

Security checks across malware telemetry and agentic risk

Overview

This is a coherent note and bookkeeping skill, but it needs Review because its helper script can escape its intended data folder and copy arbitrary local files into persistent storage.

Review this before installing if you may record sensitive personal, business, receipt, contract, or operational information. The skill should restrict record type names, confine all file writes to its data directory, limit attachments to explicit user-provided uploads, and make auto-save and attachment analysis clearer to users.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill instructs the agent to read and write persistent files under workspace/memory/list-data/ and to invoke scripts/list.py, but no permissions are declared. This creates a governance and transparency gap: the platform may not surface that the skill persists user data and attachments, increasing the chance of unauthorized or surprising data handling.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The add command accepts an arbitrary local file path in --image and copies that file into the skill-controlled attachments directory without validating that it is actually an expected user-supplied attachment. In an agent context, this can be abused to exfiltrate sensitive local files from the host environment into the skill's persistent storage, which is especially risky because the skill is marketed as a general-purpose note/record tool and may be auto-triggered by natural-language requests.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: Record type names are interpolated directly into filesystem paths via _path(t) with no normalization or allowlist, so values such as ../ can escape the intended data directory. This enables reading and writing arbitrary JSON files reachable by the process, causing unauthorized access, overwrite, or corruption of other skill or application data.

Vague Triggers

High

Confidence: 95% confidence
Finding: Using a very broad phrase like '记一下' as an auto-executing trigger can easily match normal conversation and cause unintended persistence of sensitive information. Because the skill is designed to save immediately on that phrase, accidental invocation can silently store private financial, operational, or personal data.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The invocation rules do not clearly distinguish note-taking commands from ordinary conversational references, so the agent may over-trigger in borderline contexts. In a persistence-oriented skill, ambiguous activation is risky because it can convert casual speech into stored records without clear user intent.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill explicitly allows direct saving without confirmation, yet it does not clearly warn users at the point of use that data is being persisted. This is dangerous because users may reveal sensitive spending, shipment, log, or memo content believing they are chatting casually, while the system stores it permanently.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The attachment workflow stores images/documents and may extract their contents, but it lacks an explicit privacy warning or consent step. Attachments often contain highly sensitive data such as receipts, contracts, addresses, account details, or operational screenshots, so silent archiving and OCR/content extraction increases privacy and compliance risk.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.