Security audit

ooof

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly a coherent 3D visualization generator, but it under-discloses network behavior in a page it advertises as self-contained and offline-openable.

Review before installing if you need offline or restricted-network behavior. Use trusted JSON only, prefer local image/map assets, and be aware that generated pages load code from unpkg and include external wiki/baike links; do not open or deploy outputs created from untrusted datasets without sanitizing the content first.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill instructs the agent to read local files, write output HTML, and fetch remote resources such as images and maps, but it declares no permissions. That mismatch can cause the agent or user to grant broader access implicitly than expected and creates SSRF/data-exfiltration risk if attacker-controlled URLs are supplied in the JSON inputs.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The generator accepts arbitrary HTTP(S) URLs for images and fetches them during HTML generation, which expands the skill's behavior beyond processing a local JSON dataset into making outbound requests. This can leak network metadata, enable SSRF-like access to internal resources if untrusted input controls URLs, and violates the expected offline/self-contained trust boundary described by the skill.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: Outbound network access to arbitrary user-supplied image URLs is not necessary for a safe visualization generator and creates a server-side request surface. An attacker controlling the JSON can cause requests to internal services or tracking endpoints, potentially exposing environment-specific information or abusing the host as a network proxy.

Description-Behavior Mismatch

Low

Confidence: 94% confidence
Finding: The reference explicitly instructs fetching external image resources from third-party CDNs during generation, which exceeds the stated behavior of simply turning a provided JSON dataset into a self-contained HTML file. Undeclared network retrieval can leak user prompts or generated subject matter to third parties, introduce supply-chain risk from untrusted remote content, and break expectations in restricted or offline environments.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The template is advertised as generating a self-contained HTML file, but it imports Three.js modules from unpkg and also supports loading remote map, portrait, and logo assets at runtime. This creates a supply-chain and privacy risk: opening the generated page can trigger outbound network requests, leak viewer metadata, and execute code controlled by third-party infrastructure if those resources change or are compromised.

Description-Behavior Mismatch

Low

Confidence: 86% confidence
Finding: The tooltip injects outbound links to Wikipedia and Baidu Baike, and falls back to search URLs derived from dataset titles. While not code execution by itself, this introduces undisclosed external navigation and potential privacy leakage when users click links, which conflicts with expectations for a self-contained visualization artifact.

Missing User Warnings

Low

Confidence: 82% confidence
Finding: The code performs remote fetches without an explicit user-facing warning at runtime, which is a security transparency issue. In this skill's context, users may reasonably expect offline generation from JSON only, so silent network access increases surprise and risk when processing untrusted datasets.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.