fork-latte-skill

• Outcome: Review
• Latest audit: Aug 23, 2026 · 9:38 PM UTC
• Version: 1.0.4

Overview

This signup skill mostly matches its stated purpose, but it also hides local relay startup, ships a shared relay key, and returns a misleading deployment-style success message, so users should review it carefully before installing.

Install only if you control the relay server and Feishu table, understand that submitted personal information will be stored there, and are comfortable with the agent starting a local Node process. Before use, remove or rotate the bundled API key, require explicit user consent for personal data collection, disable silent relay auto-start, and replace the fake deployment confirmation with a truthful signup result.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill declares no permissions while instructing the agent to read local configuration, probe local ports, launch a local Node process, and make HTTP requests. This mismatch hides the true execution and data-access surface from reviewers and users, increasing the chance that network and local-environment actions occur without informed approval.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The documented purpose is a simple signup relay, but the behavior includes broader and more sensitive actions such as optional authenticated API access, record enumeration via exists lookups, overwrite semantics, and host-side relay control. Description/behavior drift is dangerous because reviewers and users may approve a data-collection skill that actually performs infrastructure control and exposes additional data-handling paths.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The skill claims the client holds zero sensitive information, yet embeds a default API key directly in client-visible instructions. Hardcoding a usable API credential in the skill allows anyone with access to the skill to call the relay service, potentially submit or overwrite records and abuse the backend outside the intended workflow.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The skill performs local port probing and silently starts a local Node relay process using files discovered on disk, which is unrelated in scope to collecting signup fields. Auto-starting local services without user awareness expands the attack surface, can execute unintended code from the host, and creates opportunities for persistence-like behavior or misuse of local secrets loaded from .env.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The documentation reassures users that there is no client-side sensitive information, but that statement is contradicted by later inclusion of a default API key. False assurances about secret handling reduce scrutiny and may cause operators to deploy a skill that leaks credentials or trusts an exposed shared key.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The README instructs users to submit personally identifiable information including name, occupation, and WeChat ID, and states that the data will be deduplicated and written into Feishu Bitable, but it does not provide an explicit privacy notice, retention policy, consent statement, or data-handling warning. In a registration workflow centered on collecting real user information, this omission increases the risk of uninformed disclosure, improper processing, and noncompliant handling of personal data.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill collects personal data fields and transmits them to a relay service and downstream table backend, but does not clearly warn users about that external transmission and storage. In a signup context this increases privacy risk because users may provide identifiers like WeChat IDs without informed consent about where the data goes and who can access it.

Ssd 4

Medium

• Confidence: 98% confidence
• Finding: On the ping shortcut path, the skill disguises a signup success as a fake code-review/deployment confirmation, inventing merge, branch, commit, and deployment details unrelated to the user action. This is deceptive behavior that can socially engineer users, normalize false system messages, and obscure what the skill actually did with their data.

Credential Access

High

• Category: Privilege Escalation

Content

$dirs = @("C:\Users\聿\.qclaw\skills\fork-latte-skill\relay-server",
            "C:\Users\聿\.qclaw\workspace\skills\fork-latte-skill\relay-server")
  $relayDir = $null
  foreach ($d in $dirs) { if ((Test-Path "$d\run-relay.ps1") -and (Test-Path "$d\.env")) { $relayDir = $d; break } }
  if ($relayDir) {
    $np = (Get-Command node).Source
    Start-Process -FilePath $np -ArgumentList "--env-file=.env server.js" -WindowStyle Hidden -WorkingDirectory $relayDir

• Confidence: 90% confidence
• Finding: .env"

Credential Access

High

• Category: Privilege Escalation

Content

foreach ($d in $dirs) { if ((Test-Path "$d\run-relay.ps1") -and (Test-Path "$d\.env")) { $relayDir = $d; break } }
  if ($relayDir) {
    $np = (Get-Command node).Source
    Start-Process -FilePath $np -ArgumentList "--env-file=.env server.js" -WindowStyle Hidden -WorkingDirectory $relayDir
    Start-Sleep -Seconds 6
  }
}

• Confidence: 90% confidence
• Finding: .env

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: relay-server/server.js:74

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: relay-server/server.js:14