Ai Coach Batch Session Summary

• Outcome: Review
• Latest audit: Jul 8, 2026 · 9:10 AM UTC
• Version: 1.1.1

Overview

This skill mostly does what it says, but it handles sensitive call transcripts and publishes generated reports in ways that need careful review before installation.

Install only if you are comfortable with recording metadata and transcript-derived report content being fetched, written to local temp files, uploaded to hosted HTML links, and viewed with third-party CDN JavaScript. Prefer requiring HTTPS endpoints, fixed allowlisted upload hosts, private or expiring links, removal of bundled live test outputs, and redaction of identifiers/transcript excerpts before use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Tainted flow: 'req' from os.environ.get (line 81, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers={"Content-Type": f"multipart/form-data; boundary={boundary}"},
    )
    try:
        with urlopen(req, timeout=120) as res:
            if res.status < 200 or res.status >= 300:
                return {
                    "ok": False,

• Confidence: 90% confidence
• Finding: with urlopen(req, timeout=120) as res:

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill directs use of environment access, local file I/O, and network calls, but declares no permissions. This creates a capability/consent gap: the host or reviewer cannot accurately understand that the skill will read session-derived data, write report files, and transmit data externally. In this context, the hidden combination of transcript processing plus upload makes the omission materially risky rather than merely cosmetic.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared purpose says the skill analyzes recordings and generates a report, but the body also uploads the generated HTML to an external file-sharing service and returns a public link. That is a meaningful data-flow expansion because transcript-derived content leaves the local/runtime boundary and becomes externally accessible without being clearly disclosed in the top-level description.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The environment-variable fallback broadens host-context access beyond the stated need to obtain the current session's agent ID via session tools. Accessing environment-provided data can expose unrelated secrets or context and bypasses the tighter boundary implied by the primary session_status flow.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The skill first instructs agents not to use exec/environment guessing for agent ID retrieval, then later introduces an environment-based fallback that contradicts that restriction. This inconsistency weakens operator expectations and can normalize broader context access than intended, increasing the chance of accidental secret exposure or misuse.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The report embeds verbatim transcript excerpts and a raw user identifier directly into a generated HTML artifact, which creates unnecessary exposure of sensitive conversation content and stable identity data. In a batch-analysis skill, this exceeds the minimally necessary output and increases the risk of privacy leakage through sharing, caching, screenshots, local storage, or unintended downstream access.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: Loading Chart.js from public CDNs causes the report viewer to make external network requests when opened, disclosing access metadata and introducing a supply-chain dependency into an otherwise local reporting artifact. Because the page processes transcript-derived business content, external script loading expands the trust boundary without clear necessity.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The HTML report pulls Chart.js from third-party CDNs at render time, which introduces unnecessary outbound network access for a local transcript-summary artifact. This creates a supply-chain and privacy risk: viewing the report can disclose access metadata to external domains and allows compromised CDN content to execute arbitrary JavaScript in the report context.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The page loads Chart.js from third-party CDNs at runtime, which introduces a supply-chain and privacy risk: the report's client environment will contact external infrastructure when opened, and any compromise or unexpected change in the CDN-hosted script could affect all viewers. In the context of a batch call-summary report that may contain sensitive business/customer-derived insights, external script fetching is not necessary to the core function and increases exposure.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The template loads Chart.js from a third-party CDN at runtime, which introduces a supply-chain and privacy risk: the rendered report depends on external code outside the skill author's control, and opening the report can leak metadata such as IP address, user agent, referrer, and access timing to external infrastructure. In this skill context, the HTML report is supposed to summarize sensitive recording/transcription analysis, so pulling remote JavaScript into the viewing path is more dangerous than in a generic public webpage because business data and user activity may be associated with the report session.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The report shows transcript-derived content and an identifier without any visible privacy classification, sensitivity warning, or handling guidance. This makes accidental oversharing more likely, especially because HTML reports are easy to forward, cache, and open outside controlled systems.

External Transmission

Medium

• Category: Data Exfiltration

Content

START_TIME=$(date -v-30d +%Y-%m-%d)   # Linux 默认: date -d '30 days ago' +%Y-%m-%d
# 示例：用户说近三天 → START_TIME=$(date -v-3d +%Y-%m-%d)  # Linux: date -d '3 days ago' +%Y-%m-%d

curl -sS -X POST "http://192.168.96.17:8900/api/recordings/asr-completed" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  -d "{\"userId\":\"${AGENTID}\",\"startTime\":\"${START_TIME}\",\"endTime\":\"${END_TIME}\"}" \

• Confidence: 87% confidence
• Finding: curl -sS -X POST "http://192.168.96.17:8900/api/recordings/asr-completed" \ -H "Content-Type: application/json" \ -H "Accept: application/json" \ -d

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.