Security audit

Origin Pro MCP

Security checks across malware telemetry and agentic risk

Overview

This is a coherent Origin Pro automation skill, but it gives an agent broad unsandboxed control over a running Origin session and local project/files without enough runtime safeguards.

Install only if you trust this publisher and are comfortable giving an agent broad control of your running Origin Pro session. Keep important projects saved or backed up, avoid using it with untrusted prompts or untrusted labels/names/paths, and require explicit confirmation before raw LabTalk, new_project, project load/save, imports, or exports over existing files.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill advertises operational steps that invoke shell commands (`python -m pip install -e .`, `openclaw mcp set ...`, `pytest`) and interacts with local files and environment variables, but it does not declare any permissions or capability boundaries. This creates a trust and consent gap: an agent or reviewer may treat the skill as low-risk documentation while it actually enables package installation, local server registration, file writes, and environment-dependent execution on the host.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The graph creation path interpolates user-controlled `title` directly into a LabTalk command without escaping or validation. Because LabTalk is a command language, an attacker can break out of the quoted string and append arbitrary LabTalk statements, potentially executing unintended Origin actions, modifying projects, or triggering file/system-affecting behavior exposed through Origin automation.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: `set_axis_labels` inserts `graph_name`, `x_label`, `y_label`, and `title` into LabTalk commands with no escaping, allowing command injection through multiple parameters. In this skill, the danger is elevated because the entire purpose is Origin automation via LabTalk-capable operations, so successful injection would directly control a scientific desktop application with access to local files and project state.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The skill enables implicit invocation for a tool that controls a local Origin Pro MCP server via Windows COM automation, which can cause the agent to invoke powerful desktop automation without an explicit user request or narrowly defined trigger conditions. In this context, that increases the risk of unintended local actions, data manipulation, file export, or execution of sensitive Origin/LabTalk operations from ambiguous prompts or prompt-injected context.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The function exposes direct execution of arbitrary LabTalk script strings against a local Origin Pro COM automation object with no validation, restriction, or user warning. In an MCP/server context, this creates a powerful command-execution bridge into Origin that could modify files, run dangerous Origin/LabTalk operations, or trigger further system effects depending on what Origin and LabTalk can access.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The tool exposes raw LabTalk execution to callers with no validation, restriction, or confirmation step, allowing arbitrary commands to be sent directly into Origin Pro. In an MCP context, an LLM or downstream agent could be induced to run destructive or unsafe automation unintentionally, affecting project files, data, or local application state.

Missing User Warnings

High

Confidence: 96% confidence
Finding: The `new_project()` tool unconditionally calls `o.NewProject()`, which closes the current Origin project without saving and provides no runtime confirmation, safeguard, or state check. In an agent/MCP context, a mistaken prompt, tool-selection error, or malicious instruction chain could trigger irreversible data loss for the user's active work.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.