Security audit

project-assistant

Security checks across malware telemetry and agentic risk

Overview

The skill is a real project-analysis assistant, but it has under-scoped local file and secret-handling risks that users should review before installing.

Install only if you are comfortable with the skill scanning your repository and writing .claude docs/cache files. Do not store real Feishu tokens or API keys in its plaintext config, avoid running QA get/delete commands on untrusted project metadata, and review any Feishu report before sending it to external systems.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (23)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill advertises no explicit permissions, yet the documented commands invoke Python scripts that can read and write project files, persist configuration, execute shell-like operations, and potentially access external services through Feishu integration. This creates a transparency and consent problem: users and the platform cannot accurately scope what the skill may do, increasing the chance of unauthorized file changes, data collection, or external data exposure.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The manifest frames the skill as project initialization and Q&A, but the documented behavior extends into secret scanning, Git history inspection, CI/CD parsing, persistent document generation, cross-session config storage, and external collaboration workflows. That mismatch is dangerous because users may invoke the skill expecting narrow local analysis while it performs broader collection, persistence, and sharing actions that affect confidentiality and integrity.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The stated purpose is narrower than the documented functionality, which includes persistent configuration management, QA document lifecycle operations, and Feishu integration. This under-disclosure weakens informed consent and makes it easier for the skill to perform stateful or externally connected actions that users did not reasonably expect from a simple project assistant.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: Feishu integration introduces an external data-sharing channel that is not justified by the manifest's narrow project-analysis description. In the context of analyzing source repositories and project docs, this can expose proprietary code structure, status, or derived summaries to third-party systems without sufficiently clear disclosure.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The examples document capabilities beyond the declared skill scope, specifically Feishu integration and configuration display. This scope expansion is dangerous because it can normalize privileged operations and secret exposure that users and reviewers would not expect from a project-analysis skill, increasing the chance of misuse or accidental disclosure.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The examples portray the skill as a project assistant but also advertise Feishu sync and raw configuration display, including a token. This mismatch is risky because it hides higher-risk behaviors behind a benign description, which can mislead users into invoking actions that access integrations or reveal sensitive configuration data.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The guide states a strict boundary of 'read-only + suggestions, no direct document modification', but later defines a workflow that includes executing a document update step. This mismatch can mislead users or downstream agents into believing updates are prohibited when the documented process actually permits them after confirmation, weakening safety guarantees around external side effects.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The `delete_qa_doc` function removes a file path taken from index metadata without constraining it to the intended `.claude` QA directory. If the index file is maliciously modified or corrupted, `entry["doc_path"]` could contain path traversal such as `../../important.file`, causing deletion of arbitrary files under the project or possibly outside it.

Context-Inappropriate Capability

Medium

Confidence: 87% confidence
Finding: The cache manager explicitly treats .env files as key inputs and computes persistent hashes for them. Even though the code stores hashes rather than raw secrets, this still creates metadata about secret-bearing files and increases the chance that sensitive configuration presence, changes, and correlation data are retained in cache artifacts that may be exposed or committed.

Context-Inappropriate Capability

Medium

Confidence: 87% confidence
Finding: The utility collects and returns contributor identities, commit metadata, and the remote origin URL, which may expose internal names, emails/usernames embedded in remotes, or private infrastructure details unrelated to the stated skill purpose. In an agent skill context, this expands data access beyond minimal need and can leak sensitive repository metadata to downstream consumers or logs.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The README explicitly promotes cross-session shared configuration and lists sensitive fields such as `feishu.doc_token`, `feishu.folder_token`, and `feishu.wiki_token`, but does not warn users that these values may be persisted locally and shared across chats. In a multi-user or shared environment, this can lead to inadvertent disclosure of credentials or reuse of sensitive settings beyond the user's intended scope.

Missing User Warnings

Low

Confidence: 81% confidence
Finding: The README says the tool will automatically generate project and Q&A documentation, including paths like `.claude/project.md` and `.claude/docs/qa/...`, without warning that code-derived content and user questions may be written to disk. This can surprise users and create privacy, confidentiality, or data retention issues, especially when analyzing proprietary repositories.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The trigger conditions are broad enough to activate on ordinary project-related questions, which increases the chance the skill runs in contexts where users only wanted a conversational answer rather than automated inspection, caching, or document persistence. Because this skill also has mutating and externally integrated features, over-broad triggering raises the risk of unintended execution and data handling.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The skill documents deletion commands for configuration and QA artifacts without warning about permanence, scope, or recovery options. In a stateful assistant that writes config and documentation, omission of data-loss warnings can lead to accidental destruction of user-maintained metadata or historical records.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The Feishu integration is presented as a normal feature without a privacy warning, despite handling project-derived information that may include architecture details, file references, status, or other sensitive organizational context. In a repository-analysis skill, silent or poorly signposted external sharing materially increases confidentiality risk.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The trigger analysis shows the skill can activate on very generic terms such as “功能”, “实现”, “函数”, and “哪里”, which are common in unrelated coding questions. This can cause the skill to over-trigger outside its intended project-analysis scope, leading to inappropriate context capture, misrouting, or execution of project-specific guidance when the user did not intend to invoke this skill.

Vague Triggers

Low

Confidence: 83% confidence
Finding: The recommendations explicitly admit that trigger words may be overly broad, which confirms unresolved scope-control weakness in the skill’s activation logic. While this section is advisory rather than executable, it documents that the current trigger design lacks sufficient specificity and may continue to activate in unintended contexts.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The documentation explicitly encourages storing Feishu access tokens as ordinary configuration values and also advertises a command to display all configuration values. That creates a realistic risk of accidental secret disclosure through terminal output, logs, screenshots, shell history, or shared config stores, especially in an assistant skill that helps initialize and inspect projects.

Missing User Warnings

Medium

Confidence: 99% confidence
Finding: The example output displays a Feishu document token in plaintext without masking. Secret material shown in docs or command output can be copied, indexed, or reused by unauthorized parties, potentially enabling access to external documents or APIs tied to that token.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The configuration examples include Feishu document, folder, and wiki tokens in a form that resembles real secrets, but they are shown without any warning that they are sensitive credentials. In an agent skill context, this increases the risk that users copy secrets into chat, logs, repos, or configuration files insecurely, enabling unauthorized access to Feishu resources.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: The template is entirely written in Chinese and its output format mandates Chinese text without any user language selection or opt-in. This can cause unintended behavior, reduced usability, and policy/compliance issues in multilingual environments because the agent may override the user's preferred language.

Missing User Warnings

Low

Confidence: 81% confidence
Finding: The subsystem and process markdown paths incorporate subsystem_name and process_name directly into filesystem paths without validation or normalization checks. If these values can come from untrusted project metadata, an attacker could use path traversal sequences to overwrite arbitrary files reachable from the current user's permissions, making this more dangerous than a mere missing overwrite warning in the context of an agent skill that may process external repositories or generated metadata.

Ssd 3

Medium

Confidence: 99% confidence
Finding: The configuration example exposes a secret token in plain language, demonstrating unsafe handling of credentials. In the context of a project assistant, configuration-inspection features are especially sensitive because they may aggregate operational secrets from the user environment and encourage users to reveal them in chat or logs.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.