Security audit

smart-charts

Security checks across malware telemetry and agentic risk

Overview

This is an offline charting skill, but it needs Review because it runs AI-generated Python inside the user's environment with weak containment.

Install only if you are comfortable with the skill reading local data files you provide and generating local HTML outputs. Be especially cautious with transform-code workflows: use it on trusted datasets, inspect generated transform code for unexpected file/network operations, and prefer running it in an isolated environment for sensitive data.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

exec() call detected

High

Category: Dangerous Code Execution
Content: pass try: exec(code, global_vars, local_vars) except TimeoutError: raise TransformError( f"转换代码执行超时（超过 {self.timeout} 秒），可能存在无限循环",
Confidence: 98% confidence
Finding: exec(code, global_vars, local_vars)

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The documentation claims timeout protection on Windows via threading, but the implementation only uses signal.alarm when SIGALRM is available and otherwise silently skips timeout enforcement. On platforms without SIGALRM, untrusted transformation code can loop forever or perform excessive computation, causing denial of service.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The activation triggers are broad enough to match generic requests like 'chart' or 'analyze data', which can cause the skill to activate in contexts the user did not intend. Because this skill reads local files and writes HTML outputs with no confirmation by default, unintended invocation increases the chance of unnecessary file access or execution of risky transform workflows.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: assets/echarts.min.js:45

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/data_transformer.py:52