租赁-卖家找买家

• Outcome: Review
• Latest audit: Jul 28, 2026 · 10:43 AM UTC
• Version: 1.0.0

Overview

The skill matches its stated purpose, but it needs review because it can automatically send seller query details to a backend, queue them locally, and use admin-level credentials.

Install only if you are comfortable with seller search details and user IDs being submitted to your configured backend or stored in a local outbox when submission fails. Use a narrowly scoped service token instead of admin credentials, restrict the backend URL, protect or clean the cache/outbox directory, and expose the FastAPI service only behind appropriate access controls.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence
• Finding: The skill invokes local scripts and a web service, and its documented workflow requires environment access, file reads/writes, and network communication, yet it declares no permissions. This creates a privilege-transparency gap: operators and policy layers cannot accurately evaluate or constrain what the skill can access, increasing the risk of unintended data exposure, unauthorized outbound requests, or unsafe filesystem interactions.

Description-Behavior Mismatch

Medium

• Confidence: 85% confidence
• Finding: The documentation describes sending seller demand data to a backend and persisting failed submissions to a local outbox, which introduces data collection and retention behavior beyond the core buyer-matching function. Even though the metadata mentions query recording, this backend sync is not transparently scoped or minimized, creating unnecessary privacy and data-governance risk if user identifiers and vessel-sale intent are stored without clear consent and controls.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: Referencing optional ADMIN_API_KEY or ADMIN_TOKEN for routine demand synchronization is dangerous because administrative credentials imply elevated privileges that are not justified for a simple seller-demand submission workflow. If those secrets are used by the skill or exposed through logs, misconfiguration, or prompt/skill abuse, an attacker could gain broader backend access than necessary.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The file does more than local buyer matching: it posts seller demand payloads to a configurable remote endpoint and stores unsent payloads on disk. That creates an undisclosed data exfiltration and retention path for potentially sensitive business information, especially because the destination is controlled by environment configuration rather than being fixed and constrained in code.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: Using administrative credentials for this skill expands its privilege beyond simple buyer matching and lets the code authenticate to a backend with elevated access. If the endpoint or runtime is misconfigured, those credentials could be used to submit or influence backend data in ways unrelated to the user request.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The file describes transmitting user_id and vessel sales criteria to a backend and, on failure, writing the same data to demand_outbox.jsonl, but provides no user-facing disclosure or consent flow. This is risky because it silently exports potentially sensitive commercial intent data and may leave residual local records that are easier to access, copy, or forget to delete.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The code transmits payload data to a remote backend without any in-flow notice, consent, or disclosure mechanism. In this skill context, seller demand details may contain commercially sensitive information, so silent transmission increases privacy and compliance risk.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: When sync fails or is unconfigured, payloads are appended to a local JSONL outbox without disclosure or visible retention controls. That creates silent at-rest storage of potentially sensitive seller information that may persist longer than intended and be accessible to other local processes or users.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: When `sync_demand_record` is enabled and `user_id` is present, the code automatically sends user and query attributes to `sync_demand(...)` without any user-visible consent, notice, or minimization in this file. In a skill that processes seller intent and potentially identifying business preferences, silent synchronization can leak personal or commercially sensitive data to another service unexpectedly.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.