Nomtiq

• Outcome: Pass
• Latest audit: Jul 17, 2026 · 9:09 PM UTC
• Version: 0.5.2

Overview

This restaurant recommendation skill is mostly coherent and purpose-aligned, with some transparency gaps around optional search providers and local profile handling.

Install only if you are comfortable sending restaurant queries and destinations to Amap or Serper, and possibly to optional public-web enrichment sources if configured. Keep API keys in environment variables, review the local data stored under the skill’s data directory, and use the reset/history/companion deletion commands when needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence
• Finding: The declared description promises limited data collection and narrowly scoped providers, but the analyzed behavior indicates broader web scraping/search sources and more extensive local profiling than users would reasonably expect. That mismatch undermines informed consent and can lead to oversharing of user data, unexpected persistence of sensitive preference/social-history data, and use of undeclared third-party services.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The implementation behavior diverges from the declared skill behavior by using Serper to search Dianping pages in mainland China instead of the manifest-described Amap flow. This is dangerous because users and reviewers may rely on the manifest for data-flow expectations, while the code sends restaurant queries to a different third party and changes the trust, privacy, and policy surface without clear disclosure.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The module and CLI documentation explicitly describe the tool as a Dianping search utility, which conflicts with the skill metadata stating Amap is used in mainland China. Documentation mismatch is a security-relevant integrity issue because it can conceal actual external dependencies and network destinations from operators, reviewers, and users.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The skill adds social-media cross-verification by sending restaurant names to Serper/Xiaohongshu searches, which expands data sharing beyond the declared map-search scope in the manifest. This is dangerous because user-derived location and preference context can be transmitted to an undeclared third-party search flow, creating privacy and trust issues even if the data is not highly sensitive.

Context-Inappropriate Capability

Low

• Confidence: 79% confidence
• Finding: The code integrates Baidu Maps despite the metadata stating China uses Amap and overseas uses Google Maps via Serper. This mismatch is a security-relevant capability expansion because it introduces an undeclared external data recipient and extra API key handling, reducing transparency and increasing the attack/privacy surface.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script persists restaurant preferences, dislikes, locations, and inferred taste-profile data to a local JSON file without any in-file notice, consent check, retention control, or access protection. This creates a privacy risk because sensitive behavioral preference data is stored by default and could be exposed to other local users, copied by other components, or retained longer than the user expects.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The file-level behavior and comments explicitly tie China-mainland destinations to Chinese-language handling, and the routing logic later derives a response locale from destination rather than requiring user consent. This can override user preference and cause unintended disclosure or exclusion risks in multilingual contexts, especially when users expect a different output language.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The code concatenates raw user input plus stored profile data, companion preferences, historical inputs, and prior reasoning directly into an LLM prompt. This creates a prompt-injection and privacy exposure surface: untrusted text from prior sessions can influence downstream model behavior, and sensitive personal preference/history data may be unnecessarily disclosed to the model or any connected provider.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.