Security audit

data-skill

Security checks across malware telemetry and agentic risk

Overview

This is a real local data-analysis skill, but it needs review because its privacy-focused claims are broader than its actual network, server, cleanup, and persistence behavior.

Install only if you are comfortable with a data-analysis skill that runs local Python/SQL, creates persistent SQLite and output files, and may start a local web server for chart previews. Avoid using Baidu geocoding or remote chart templates with sensitive addresses or business data unless you explicitly intend that network access, and review cleanup actions before allowing table deletion.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (29)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 97% confidence
Finding: The skill explicitly instructs the agent to read and write local files, execute shell commands, and in chart workflows start a local HTTP server and potentially use network-backed geocoding, yet no permissions are declared. This creates a capability/consent gap: users and the platform cannot accurately assess or constrain what the skill may do, increasing the risk of unintended file access, command execution, or data exposure.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill is described as local and privacy-preserving, but the documented behavior includes external Baidu map/geocoding API use, local HTTP serving of generated charts, and persistent metadata/cache files. That mismatch is security-relevant because users may provide sensitive office data under the assumption it never leaves the machine or becomes accessible over a server endpoint.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The prompt directs generated chart code to load an external HDR asset from echarts.apache.org, which introduces network egress and a third-party dependency into a skill advertised as using local code execution and preserving data privacy. In a data-analysis context, this can leak environment metadata, violate offline/privacy expectations, and normalize remote resource fetching in generated code.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The prompt explicitly instructs the generated chart to use externally hosted image URLs. In a skill advertised as local and privacy-preserving, this creates an avoidable network dependency that can leak usage metadata, break in offline/private environments, and expose users to third-party resource tracking or content changes.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The template demonstrates data loading via $.getJSON from a web-style asset path, encouraging generated output to rely on fetch-style external or server-hosted retrieval instead of local in-memory or local-file data handling. In this skill context, that conflicts with the promised local processing model and can cause unintended network access or architectural drift toward less private execution patterns.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The prompt instructs generation of ECharts config that references an external HDR asset URL, which introduces network-dependent resource loading into a skill described as local-only and privacy-preserving. In a data-analysis context, this can cause unintended outbound requests, metadata leakage, and a mismatch between declared and actual capability boundaries.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The embedded toolbox action enables exporting 3D model data as a downloadable asset unrelated to the stated office-data analysis purpose. This expands the skill's effective data egress surface and could allow transformed or derived data to be exported in unexpected formats, weakening least-privilege expectations.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The prompt explicitly instructs use of an external image resource URL, which creates a network dependency inconsistent with a privacy-preserving local data-processing skill. In practice, this can cause clients rendering the generated ECharts config to fetch remote assets, leaking usage metadata and potentially violating data-handling expectations in supposedly local workflows.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The embedded ECharts skeleton hardcodes a remote HDR texture reference, which can trigger outbound requests when the chart is rendered. In a skill marketed for local/private analysis, this is dangerous because it silently expands the trust boundary to a third-party host and may expose environment, timing, or user activity data.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The prompt explicitly instructs the model to preserve and request an external image URL, which creates a path for network-loaded resources despite the skill being described as local and privacy-preserving. In a data-analysis skill, this can enable unintended outbound requests, leak usage context or identifiers, and weaken user expectations around offline/private handling of data and artifacts.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The ECharts skeleton references an Apache-hosted HDR asset through ambientCubemap.texture, introducing a concrete external dependency into code that is supposed to operate locally. If rendered in an environment with network access, this may trigger outbound fetches and create privacy, tracking, and supply-chain exposure inconsistent with the skill's stated trust boundary.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The prompt normalizes use of external network image resources for a routine office data-analysis scenario where such access is not necessary. Unnecessary network capability broadens the attack surface and can be abused to introduce tracking endpoints, untrusted content, or hidden data egress channels through chart assets.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The prompt explicitly requires an externally hosted image resource URL even though the skill is positioned as local, privacy-preserving data analysis. This creates a data-flow and deployment inconsistency: rendered charts may depend on network access or encourage users to fetch third-party assets, which can leak usage metadata, break offline/privacy expectations, and expand the attack surface.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The chart prompt depends on a network-hosted asset that is unnecessary for ordinary office data analysis and not justified by the skill's stated purpose. In a privacy-sensitive local-processing skill, this can cause unexpected outbound requests to third-party infrastructure, exposing environment, timing, or user-driven metadata and undermining trust in local-only handling.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The function geocodes arbitrary addresses by sending them to Baidu's external API and stores results locally, which contradicts the skill's stated local/private processing model. If users process sensitive office data containing customer, employee, or site addresses, this causes unannounced third-party data disclosure and may violate privacy or compliance expectations.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: This code sends address data over the network to a third-party geocoding service without clear necessity from the skill's described office-analysis purpose. In this context, the mismatch between advertised local analysis and actual external transmission makes the behavior more dangerous because users are likely to trust that their data stays private.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The script performs destructive cleanup by dropping tables based on metadata and age, which is dangerous in a data-analysis skill because a mistaken cutoff, poisoned metadata, or an unexpected table name can cause irreversible data loss. The risk is increased because the DROP statement interpolates the table name directly into SQL, so corrupted or attacker-controlled metadata could lead to unintended schema modification or cleanup of the wrong objects.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The script accepts a user-controlled --file path and joins it with the project base directory without validating or constraining the final destination. An attacker can supply traversal-style paths or absolute-path behavior via os.path.join semantics to append content to unintended files writable by the process, which exceeds the stated data-analysis purpose and could enable tampering with project documents or operational files.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The skill spawns and manages a persistent background HTTP server even though its stated purpose is local data processing. That creates an unnecessary long-lived service and expands exposure beyond the expected trust boundary, especially in a privacy-sensitive data-analysis skill handling local files.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The HTTP handler serves files from the working directory and sets Access-Control-Allow-Origin: * for all responses. In the context of a data-analysis skill that may process sensitive local datasets, this permissive CORS configuration increases the risk that web content on the user's machine could read server-exposed files and extracted artifacts.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The activation scope is broad enough to match many ordinary office-data requests, which can cause the skill to trigger in contexts where users did not intend code execution, file manipulation, or database import workflows. Because this skill can run shell commands and modify local state, over-broad triggering materially raises the chance of unintended high-privilege actions.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: Scenario 2 uses a vague trigger for common actions like filtering, sorting, or adding columns, which could cause automatic SQL execution and table creation for loosely related requests. In a skill with shell and database capabilities, ambiguous triggers increase the risk of unintended data transformations, writes, and state changes without sufficiently explicit user authorization.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The workflow states that chart generation will automatically start a local HTTP server and return an access URL, but it provides no warning, consent step, binding restriction, or discussion of exposure scope. Serving generated HTML can expose sensitive embedded data to other local users or, if misconfigured to bind beyond localhost, to the network.

Missing User Warnings

Medium

Confidence: 79% confidence
Finding: The cleanup workflow instructs deletion of tables and metadata older than 30 days without requiring confirmation, previewing what will be removed, or warning that data may be irrecoverably lost. In a data-processing skill that maintains local databases and metadata, silent cleanup can destroy important records and undermine the advertised non-destructive/undo-oriented model.

Missing User Warnings

Low

Confidence: 92% confidence
Finding: The prompt explicitly tells the generated chart code to load remote image assets and example data URLs, but does not require informing the user that network access will occur. In a data-processing skill that emphasizes privacy and local execution, silent external fetches can leak usage context, violate user expectations, and weaken offline/privacy guarantees even if the fetched resources are only static assets.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: assets/echarts/echarts.min.js:45