Security audit

support-to-repro-pack

Security checks across malware telemetry and agentic risk

Overview

This skill is a legitimate support-ticket packaging tool, but its sanitization promises are stronger than the artifacts support, so sensitive customer data could remain in generated outputs.

Review before installing if you handle real customer data. Use only with authorized inputs, inspect all generated files before sharing, avoid ZIP packaging until outputs are checked, and do not rely on the tool's current redaction as complete protection for logs, screenshots, URLs, tokens, or derived timeline and stack-trace files.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill instructs the agent to read user-supplied files, write temporary and output files, and invoke tooling that may access the environment, but it declares no permissions or user-consent boundaries. This creates a real security issue because sensitive local data could be accessed or persisted without explicit authorization and without platform enforcement tied to declared capabilities.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The README advertises very broad natural-language trigger phrases like '帮我整理这个客户 bug' and 'turn this ticket into an engineering issue' without clear guardrails on allowed inputs, review requirements, or sensitivity boundaries. In a skill that handles customer tickets, logs, chats, and screenshots, this increases the chance of accidental invocation on highly sensitive material and over-broad automation of data handling.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The README states that customer tickets, logs, screenshots, and chat records are processed, and explicitly says Claude performs semantic analysis, but it does not clearly warn that submitting raw materials to the model may expose sensitive customer data beyond the deterministic redaction layer. Because screenshots and free-text materials can contain PII or secrets that regex-based redaction may miss, users may unknowingly send confidential data into AI analysis workflows.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill directs the agent to save pasted support content to a temporary file, but provides no user-facing notice that customer data may be written to local storage. Since the content being handled explicitly includes tickets, logs, and screenshots that may contain sensitive information, silent persistence materially increases confidentiality and retention risk.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The workflow instructs the agent to read user-provided file paths and screenshots, which can expose sensitive local data well beyond what the user may expect if path handling is broad or ambiguous. In a skill designed to process customer materials, this is especially risky because those files are likely to contain PII, internal URLs, credentials, or proprietary screenshots.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The packaging step writes multiple derived artifacts and a ZIP archive to disk without warning the user that sanitized-but-still-sensitive materials, analyses, and metadata will be persisted. Even if redacted, these outputs may retain confidential business context, incident details, or incomplete redactions, creating secondary leakage and retention risks.

Natural-Language Policy Violations

High

Confidence: 99% confidence
Finding: The log line includes a bearer token in plain text alongside a public IP, which is a sensitive credential disclosure. Anyone with access to the logs could reuse the token for unauthorized API access, and the skill context increases risk because this skill explicitly processes and sanitizes logs, so failing to redact such data would propagate secrets into issue packs and broader internal sharing.

Natural-Language Policy Violations

Low

Confidence: 93% confidence
Finding: The log line exposes a specific user's email address in plain text, which is personally identifiable information and unnecessary for diagnosing the timeout itself. In the context of a skill whose purpose is to sanitize logs before creating issue packs, retaining raw identifiers is more dangerous because it can propagate sensitive data into tickets, summaries, and downstream systems.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The file contains multiple categories of highly sensitive data in raw form, including a phone number, email address, tenant identifier, national ID number, plaintext password, and API token. In the context of a skill explicitly meant to sanitize support tickets and logs into issue packs, retaining unsanitized secrets and PII is especially dangerous because it can propagate credentials and personal data into broader engineering workflows, issue trackers, and test artifacts.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The human-readable report explicitly includes `m.original_snippet`, which re-discloses the very PII the redaction system is supposed to sanitize. In this skill’s context, reports are likely shared with support and engineering for handoff, so embedding original sensitive values undermines redaction and can leak customer data into downstream tickets, chat, or logs.

Ssd 3

High

Confidence: 99% confidence
Finding: This output path emits original sensitive snippets in a human-readable summary, creating a direct data exposure channel. Because the skill is designed to sanitize support tickets, logs, and screenshots into reproducible issue packs, this behavior is especially dangerous: the leaked snippets are likely to propagate into engineering artifacts where access is broader and retention is longer.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: examples/case_hard/input_ticket.md:17

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: tests/conftest.py:23

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: tests/test_redactor/test_patterns.py:44