Industry Deep Report

• Outcome: Review
• Latest audit: Jun 10, 2026 · 4:12 PM UTC
• Version: 1.0.8

Overview

This paid report skill is mostly coherent, but it sends user questions and payment credentials to a hard-coded server over unencrypted HTTP.

Review before installing. The skill performs the advertised paid report workflow, but it uses an unencrypted hard-coded HTTP backend for order creation and fulfillment, including payment credentials during report generation. Avoid using it for confidential business questions or payment flows unless the publisher updates it to HTTPS, documents data handling and retention, and removes the instruction to expose internal reasoning.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The skill explicitly instructs the agent to include its 'thinking process' in user-facing responses. Exposing chain-of-thought can leak hidden reasoning, internal decision criteria, and security-relevant workflow details that are unnecessary for delivering a market report. In a paid workflow that also touches credentials and payment state, this increases the risk of prompt extraction and disclosure of sensitive internal logic.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: The script stores the user's question together with payment metadata, encrypted payload data, and payee details locally, but there is no visible minimization, retention control, access restriction, or disclosure. If local files are exposed or reused by other components, sensitive business queries and payment context could be leaked.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill describes automatic reading of order JSON data and `payCredential` from a fixed local directory to continue payment and fulfillment, but it does not clearly disclose this local data access to the user as part of the workflow. Because the skill has `credential.read` and outbound network capability, undisclosed local credential/order-data use can undermine informed consent and create risk of unintended payment processing or sensitive metadata exposure.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The code transmits the user's question to a remote API over plain HTTP, not HTTPS, and there is no evidence of user disclosure or consent. This creates both a privacy risk and a transport-security risk because sensitive competitive-intelligence queries can be intercepted or modified in transit.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The script sends both the user's question and a payment credential to a hard-coded endpoint over plain HTTP, which provides no transport-layer confidentiality or integrity. An attacker on the network path could intercept or modify the credential, tamper with payment status responses, or harvest sensitive user/business data from the submitted report request. In a paid report-generation skill, this is more dangerous because the question content may contain proprietary competitive-intelligence prompts and the credential appears to gate paid access.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The instruction to reveal chain-of-thought is a direct security issue because it can expose internal reasoning, hidden policies, validation steps, and workflow logic to users. In a skill that handles payment orchestration, reads local order/payment state, and may continue from existing orders, such disclosure can help an attacker map internal controls, craft bypass attempts, or extract sensitive operational details.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.