Security audit

Skill Publish

Security checks across malware telemetry and agentic risk

Overview

This skill appears to do what it claims: locally process an insurance product folder and save a Markdown report, with no hidden network or destructive behavior found.

Before installing, edit config.json to point to your own staging or Obsidian folder, run it only on a narrow product-material directory, and expect extracted quotes and tables to be stored locally in .product-cache and possibly in a synced notes vault. Pin or lock dependency versions for safer repeatable installs.

SkillSpector

By NVIDIA

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (13)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 97% confidence
Finding: The skill clearly directs local file reads and writes, including generating artifacts and writing Markdown into an Obsidian path, yet it declares no permissions or user-facing capability boundaries. This creates a transparency and consent gap: an agent may modify local files or traverse user-provided directories without the operator understanding the scope of access.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The README explicitly states that generated Markdown will be written directly into an Obsidian knowledge base, but it does not warn users about local file modification, possible overwrites, or the need to review the destination path before running the tool. In a skill that processes arbitrary product directories and automates output generation, this increases the risk of unintended writes into a user’s notes repository, causing data loss, corruption, or confusing provenance of generated content.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The activation description is broad enough that the skill could trigger on many insurance-analysis requests without clearly limiting when it should or should not run. Over-broad invocation increases the chance an agent will execute a workflow involving local processing and file writes in situations where the user expected only advice or a lightweight summary.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill's primary purpose includes writing output directly into the user's Obsidian knowledge base, but it does not require a prominent warning or explicit consent immediately before modification. Automatic knowledge-base writes can overwrite notes, create unexpected files, or persist sensitive insurance data into a synced repository without the user's informed approval.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The workflow instructs execution of local Python commands that build caches, parse documents, generate reports, and ultimately support file writes, but it lacks a clear warning and consent checkpoint before these actions. Running local scripts over user directories can have side effects, consume resources, create hidden cache folders, and process sensitive documents beyond what the user expects.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The script persists `report-input.json` containing extracted facts, citations, and verbatim quotes from insurance product documents, which may include sensitive or proprietary content. In this skill’s context, the output is explicitly intended for downstream knowledge-base ingestion, so writing a consolidated cache file without minimization, access controls, retention limits, or operator warning increases the risk of unintended disclosure through local storage, backups, sync tools, or later reuse.

Unpinned Dependencies

Low

Category: Supply Chain
Content: # Core dependencies pdfplumber>=0.10.0 pypdfium2>=4.0.0 Pillow>=10.0.0 openpyxl>=3.1.0
Confidence: 92% confidence
Finding: pdfplumber>=0.10.0

Unpinned Dependencies

Low

Category: Supply Chain
Content: # Core dependencies pdfplumber>=0.10.0 pypdfium2>=4.0.0 Pillow>=10.0.0 openpyxl>=3.1.0 xlrd>=2.0.0
Confidence: 92% confidence
Finding: pypdfium2>=4.0.0

Unpinned Dependencies

Low

Category: Supply Chain
Content: # Core dependencies pdfplumber>=0.10.0 pypdfium2>=4.0.0 Pillow>=10.0.0 openpyxl>=3.1.0 xlrd>=2.0.0 pandas>=2.0.0
Confidence: 95% confidence
Finding: Pillow>=10.0.0

Unpinned Dependencies

Low

Category: Supply Chain
Content: pdfplumber>=0.10.0 pypdfium2>=4.0.0 Pillow>=10.0.0 openpyxl>=3.1.0 xlrd>=2.0.0 pandas>=2.0.0
Confidence: 92% confidence
Finding: openpyxl>=3.1.0

Unpinned Dependencies

Low

Category: Supply Chain
Content: pypdfium2>=4.0.0 Pillow>=10.0.0 openpyxl>=3.1.0 xlrd>=2.0.0 pandas>=2.0.0 # Optional: OCR support (only needed if enable_ocr=true in config.json)
Confidence: 90% confidence
Finding: xlrd>=2.0.0

Unpinned Dependencies

Low

Category: Supply Chain
Content: Pillow>=10.0.0 openpyxl>=3.1.0 xlrd>=2.0.0 pandas>=2.0.0 # Optional: OCR support (only needed if enable_ocr=true in config.json) # rapidocr-onnxruntime>=1.3.0
Confidence: 92% confidence
Finding: pandas>=2.0.0

Known Vulnerable Dependency: Pillow==10.0.0 — 10 advisory(ies): CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2024-28219 (Pillow buffer overflow vulnerability); CVE-2026-55379 (Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()`) +7 more

Critical

Category: Supply Chain
Confidence: 96% confidence
Finding: Pillow==10.0.0

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.