Security audit

qa-req2testcase-generator

Security checks across malware telemetry and agentic risk

Overview

The skill performs the advertised test-case generation, but it also has default external review uploads, broad local file discovery, and credential persistence that require careful review before installation.

Install only if you are comfortable with requirement-derived content leaving the local machine. Before using it with confidential documents, disable or remove the bundled cloud review configuration, remove hardcoded API keys, require HTTPS endpoints, provide explicit file paths instead of allowing broad discovery, and avoid entering shared passwords through chat unless the credential storage behavior has been fixed.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (77)

os.system() or os exec-family call

High

Category: Dangerous Code Execution
Content: from lxml import etree except ImportError: print("❌ 依赖缺失，正在安装 python-docx lxml ...") os.system(f"{sys.executable} -m pip install python-docx lxml -q") from docx import Document from docx.opc.constants import RELATIONSHIP_TYPE as RT from docx.oxml.ns import qn
Confidence: 97% confidence
Finding: The module automatically runs a shell command to install packages at import time using os.system, which executes external code without explicit user approval. In a skill whose stated purpose is requirement-to-testcase generation, this behavior is unnecessary and expands the attack surface by allowing network access and arbitrary package installation side effects.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill declares no permissions even though the documented workflow clearly relies on shell execution, file read/write, environment variables, network access, and orchestration logic. This creates a transparency and governance gap: operators may approve or invoke the skill without understanding that it can access local files, execute commands, and transmit data externally.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The declared purpose is requirement-to-testcase generation, but the skill behavior expands into OCR/vision APIs, cloud synchronization, review pushing, export pipelines, state/gate management, and broader orchestration features. This mismatch is dangerous because users may supply sensitive requirement documents expecting local analysis, while the skill can perform materially broader processing and outbound actions than its description suggests.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The changelog describes the skill accumulating broad capabilities far beyond requirement-to-testcase generation, including cloud sync, review push, attachment discovery, OCR/vision, and file export workflows. This kind of scope creep increases the attack surface materially: even if each feature is individually explainable, bundling unrelated data-access and network behaviors into one skill creates unnecessary privilege concentration and raises the chance of unintended data exposure or misuse.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The documented behavior searches common user directories and may broaden to wider disk searches for recently modified documents, which is excessive for a testcase-generation skill. This can expose unrelated sensitive files, violate user expectations of file access boundaries, and enable accidental ingestion of confidential local data simply because it is recent and matches an extension.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: Cloud review push and knowledge synchronization introduce outbound data transfer paths that are not essential to the core requirement-to-testcase function. If enabled by default or insufficiently scoped, these features can leak requirement contents, testcase artifacts, project metadata, or internal knowledge to external services, expanding confidentiality and compliance risk.

Description-Behavior Mismatch

Medium

Confidence: 84% confidence
Finding: The changelog indicates review push delivery is enabled by default, which introduces outbound data transfer beyond simple testcase generation. If requirement documents or generated cases contain proprietary or regulated information, default pushing can leak sensitive material to external review systems without clear user intent.

Context-Inappropriate Capability

Medium

Confidence: 80% confidence
Finding: The skill documents dependence on Tencent Cloud API for image understanding, introducing external network transmission of image-derived requirement content. For a requirement-analysis skill, this is sensitive because screenshots, diagrams, and embedded text may contain confidential product plans or customer data that leave the local trust boundary.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The configuration enables external cloud review and sync endpoints, including automatic push behavior, even though the skill’s stated purpose is only requirement-to-testcase generation. This creates an unjustified data egress path that could transmit sensitive requirement documents, test artifacts, or metadata to a remote server, expanding the attack surface beyond user expectations.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: Automatic submission to a cloud review service is risky because it can silently exfiltrate user-provided requirements or generated test cases to an external host without clear necessity for the skill’s core function. The danger is heightened by the use of plain HTTP and an embedded API credential, which makes interception and unauthorized reuse more likely.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: Experience synchronization to an external 'L6 experience library' is not aligned with testcase generation and introduces a secondary outbound data-sharing channel. Even with auto_sync currently disabled, the feature’s presence increases risk because it normalizes external transfer of potentially proprietary project knowledge and may be enabled later without adequate review.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The PB服务 state transition points to '强制平仓', but that target state is not declared in the PB服务 state list. This creates an inconsistent state model that can cause downstream generators, validators, or workflow engines to omit, mishandle, or incorrectly test a critical risk-control path.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The example is labeled and scaffolded as an asset-management/portfolio testcase, but the actual scenario is a retail mutual-fund subscription flow. In a requirement-to-testcase generator, mismatched examples can poison prompting behavior, causing the agent to generate materially incorrect tests for the wrong business domain and silently reduce coverage of real controls.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: This testcase mixes portfolio rebalancing metadata and holdings setup with a fee-tier check for mutual-fund purchase. Such contradictory exemplars are dangerous in an AI skill because they teach the model to ignore contextual constraints and can lead to generation of invalid or misleading testcases that appear plausible to reviewers.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The testcase combines risk-control review setup with a retail-style subscription operation, creating a domain/workflow contradiction. In this skill context, that can mislead the generator into merging unrelated business processes, producing tests that miss approval controls or validate the wrong functionality altogether.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: Although framed as asset-management portfolio work, the testcase actually checks a minimum subscription amount for a mutual-fund flow. Because examples guide generation patterns, this inconsistency can systematically skew output toward the wrong product logic and leave genuine portfolio-management behaviors untested.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The preconditions emphasize lack of portfolio-management permission, but the testcase validates subscription increment rules instead of authorization behavior. This is dangerous because it can train the skill to disregard security-relevant preconditions, leading to generated tests that omit access-control verification and create false confidence in coverage.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The onboarding flow authorizes broad shell execution, filesystem inspection, package installation, cache manipulation, and persistent writes that exceed what is reasonably necessary for converting requirements into test cases. Even if intended for setup, these capabilities materially expand the agent’s authority and create opportunities for host enumeration, unintended data modification, and execution of unsafe commands.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The skill instructs searching broad host paths and reading environment variables to locate tooling, which amounts to local environment discovery beyond the stated business purpose. This can expose filesystem structure and deployment details, and it normalizes host probing behavior that could be abused in more harmful variants.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: Directing the agent to run pip install modifies the runtime environment and may pull code or packages into the system without explicit user approval. For a test-case generator, this is unnecessary privilege escalation in practice and can destabilize the environment or introduce supply-chain risk.

Intent-Code Divergence

High

Confidence: 90% confidence
Finding: The file claims manual exec/read/write instructions should not be followed directly, yet immediately includes numerous such commands. This contradiction can bypass reviewer trust signals and make unsafe operational behavior appear sanctioned, increasing the likelihood that an agent or maintainer executes dangerous actions.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The file explicitly claims manual tool execution has been replaced by orchestrator actions, yet it continues to embed direct `exec` and `read` instructions throughout the workflow. This mismatch is dangerous because downstream agents may follow the lower-level commands anyway, bypassing intended centralized controls, audit points, and policy enforcement in the orchestrator.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The skill adds a persistent learning workflow that stores user-modified Excel-derived experience data into a reusable knowledge base, which expands behavior beyond one-shot testcase generation. This creates a data retention and cross-task reuse path that can capture sensitive project details, test logic, or proprietary business processes without clear scope restriction or isolation guarantees.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The skill adds an online review-platform push capability that is outside the stated requirement-to-testcase generation scope. That scope expansion creates an unnecessary data-exfiltration path for generated test cases and possibly embedded requirement content, especially because the destination, data handling, and consent boundaries are not clearly defined.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The skill requests a shared password to enable external services unrelated to the core task and instructs the agent to hold it in session memory and transmit it for verification. This creates credential-handling risk, encourages users to disclose secrets to the skill, and broadens the attack surface with an external authenticated integration that is not necessary for testcase generation.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.install_untrusted_source

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: tools/image_api_server/server.py:378

Install source points to URL shortener or raw IP.

Warn

Code: suspicious.install_untrusted_source
Location: config/cloud.json:5

Install source points to URL shortener or raw IP.

Warn

Code: suspicious.install_untrusted_source
Location: user_knowledge/preferences.json:7