atypica-user-interview

• Outcome: Pass
• Latest audit: May 29, 2026 · 8:29 PM UTC
• Version: 1.0.0

Overview

This is a disclosed atypica.ai integration for simulated user interviews, with real privacy considerations around external research data, public report links, and verbose logs.

Install only if you are comfortable sending research prompts, product ideas, persona queries, and generated outputs to atypica.ai under your account. Avoid regulated or highly confidential data unless your organization approves the service, keep API keys and chat/report tokens private, do not share public report links casually, and avoid verbose mode when prompts or responses contain sensitive information.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The skill is presented as a user-interview/focus-group capability, but the reference documents additional artifact-generation and retrieval flows for reports and podcasts, including shareable URLs. This scope expansion matters because an agent granted this skill could access and distribute outputs beyond the narrowly described interview function, increasing data exposure and unintended use risk.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The persona introspection endpoint returns the full persona prompt, which can reveal proprietary system prompts, hidden instructions, or sensitive behavioral templates not necessary for conducting interviews. In the context of a skill meant to simulate users, exposing raw persona prompts exceeds least privilege and enables prompt harvesting or reverse engineering of private personas.

Description-Behavior Mismatch

Low

• Confidence: 84% confidence
• Finding: The API reference explicitly states that `get_messages` can read both universal and study chats, which is broader than a user-interview-specific skill implies. Even if ownership checks exist server-side, this broader read capability increases the blast radius of any accidental or induced misuse by an agent and weakens scope isolation.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: Verbose logging around the HTTP call can expose sensitive operational data, including the full request payload and potentially the bearer token via command-line/process inspection or adjacent debug output. In this skill, prompts, persona inputs, and returned research content may contain confidential user research data, so debug logs materially increase disclosure risk.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger guidance is very broad and includes common phrases like 'talk to users' and 'get user feedback,' which could cause the skill to activate in routine conversations where the user did not intend to send prompts or data to an external service. Because this skill initiates external research workflows and may generate/share reports, accidental invocation increases privacy and data handling risk.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The documentation explicitly surfaces a public `shareUrl` for generated reports but does not prominently warn that the link is public or discuss the privacy implications of sharing potentially sensitive interview prompts, synthesized findings, or embedded user/business data. In a research skill, reports may contain confidential product plans, customer insights, or personal data, so normalizing public sharing without clear warning materially increases disclosure risk.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script logs the full JSON request payload in verbose mode, which can include user-supplied research prompts, chat tokens, and other sensitive input. Because this is a user-interview skill handling potentially proprietary product plans or internal research questions, exposing request contents to stdout/stderr or log collectors creates an unnecessary data-leak path.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Verbose mode prints the first 500 characters of the raw API response, which may contain sensitive generated content, persona outputs, chat identifiers, or other returned data. Even partial responses can reveal confidential information and may be captured by terminal history, CI logs, or centralized logging systems.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.