海关知识产权备案查询

• Outcome: Review
• Latest audit: May 28, 2026 · 10:49 AM UTC
• Version: 1.0.0

Overview

This skill appears to perform the advertised customs lookup, but it should be reviewed because it installs unpinned browser-automation code at runtime, reuses a local virtual environment, stores query history locally, and uses WAF-bypass framing.

Install only if you are comfortable with the skill creating or using a Python virtual environment, downloading unpinned nodriver from public package indexes, opening Chrome to the listed customs site, and saving searched brands plus results in a local CSV. Prefer a revised version with pinned dependency versions and hashes, explicit confirmation before installs and online queries, narrower trigger wording, clearer cache deletion or no-cache controls, and removal of WAF-bypass language.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

print(json.dumps({"action": "install_deps", "mirror": mirror, "cmd": " ".join(pip_args)}))

    try:
        result = subprocess.run(pip_args, capture_output=True, text=True, timeout=120)
        if result.returncode == 0:
            return True
        elif not mirror:

• Confidence: 84% confidence
• Finding: This code automatically installs and executes a third-party package at runtime, including fallback to an alternate package mirror, which creates a supply-chain risk if the package or mirror is compromised. In a skill whose purpose is merely querying a website, self-installation significantly enlarges the trust boundary and can lead to arbitrary code execution under the user's account.

os.system() or os exec-family call

High

• Category: Dangerous Code Execution

Content

if not _is_in_venv():
        venv_python = _get_venv_python()
        if venv_python:
            os.execv(venv_python, [venv_python] + sys.argv)

    brand = args.brand.strip()
    csv_path = args.cache_file or get_csv_path()

• Confidence: 81% confidence
• Finding: The script replaces itself with a Python interpreter found in a local .venv directory without any integrity check on that interpreter. If an attacker can plant or tamper with the .venv contents in the skill directory, this becomes a straightforward local code-execution pivot under the context running the skill.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The skill includes environment creation, package installation, and interpreter switching behaviors that are not necessary for a simple search workflow. This overprivileged design increases attack surface and makes compromise of dependencies or local files materially more dangerous.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The trigger phrases are broad enough to match ordinary discussion about customs filing, brand compliance, or备案状态, which can cause the skill to activate unexpectedly. Because the skill can launch browser automation, install dependencies, and persist results locally, accidental invocation has meaningful side effects and elevates the risk beyond a simple UX issue.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill persistently stores query results in a local CSV file, including brand search history and returned records, but the description does not clearly warn the user before data is written. Undisclosed local retention can leak business-sensitive investigation history to other users or processes on the same machine and may violate user expectations or data-handling requirements.

Missing User Warnings

Medium

• Confidence: 77% confidence
• Finding: The script sends user-supplied brand queries to a remote government site and persists results to a local CSV cache without an explicit consent prompt or clear disclosure at runtime. This creates privacy and operational risk because sensitive query history may be stored or exposed unexpectedly, especially in shared workspaces.

Natural-Language Policy Violations

High

• Confidence: 97% confidence
• Finding: The script explicitly states that it will 'bypass WAF protection,' indicating deliberate evasion of a target site's defensive controls. Even if the implementation is framed as automation, this materially raises security and policy risk because it normalizes access-control circumvention and can lead to account blocking, legal issues, or misuse of the skill for unauthorized scraping.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.