Security audit

Ioc Patrol Report

Security checks across malware telemetry and agentic risk

Overview

This skill is a building-operations report generator, but it ships with a real remote database credential and queries hard-coded operational tables beyond what users are clearly told.

Review this skill before installing. Replace or remove the bundled database configuration, do not run it against the included remote PostgreSQL credential, verify exactly which tables it queries, and store generated reports only in an access-controlled location.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 85% confidence
Finding: The skill documentation and structure indicate access to environment variables, database credentials, and report files, but no explicit permissions are declared. This creates a transparency and consent problem: users may invoke a skill that reads secrets and writes files without a clear permission boundary. In a report-generation skill handling operational building data, undeclared access increases the chance of unintended data exposure or unauthorized file writes.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The documented behavior does not match the reported actual behavior: the skill reportedly queries personnel access data, ignores configured table names, omits real alarm retrieval, and claims HTML output it does not implement. Behavior/description mismatch is dangerous because it defeats informed consent and can conceal access to sensitive datasets unrelated to the stated purpose. In a building-operations context, personnel access records may be security-sensitive and privacy-sensitive.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The report footer always claims the data source is the real-time IOC database, even when the script fell back to mock data after a DB failure. In an operational building-management context, this can cause false trust in fabricated report contents and lead to incorrect maintenance or incident-response decisions.

Missing User Warnings

Medium

Confidence: 80% confidence
Finding: The documentation instructs users to connect to a PostgreSQL database and generate reports to disk, but it does not warn that operational data will be accessed and persisted locally. This omission can lead users to expose sensitive building telemetry, incidents, or work-order details in report files without considering retention, access control, or storage location. The risk is higher because automated report generation can repeatedly create sensitive artifacts.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The trigger list is broad and contains generic operational phrases such as '运维报告', '智能运维', and 'patrol report', which can overlap with ordinary user requests and cause the skill to activate unintentionally. In this skill, unintended activation is more concerning because the skill is designed to access a PostgreSQL-backed operational reporting workflow, which could expose internal building/operations data or invoke sensitive report generation in the wrong context.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.