Security audit

Calliper SaaS Markdown

Security checks across malware telemetry and agentic risk

Overview

This skill transparently compares two user-supplied documents by uploading them to a disclosed SaaS API and returning Markdown differences.

Install this only if you are comfortable sending the selected documents and any optional config to the configured Calliper/PDRouter API. Use scoped API credentials, verify PD_ROUTER_BASE_URL before running, and avoid sending sensitive files unless that external processing is acceptable.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill invokes a Node.js script that reads environment variables containing bearer tokens and performs outbound network requests, but the skill declares no explicit permissions for those sensitive capabilities. This creates a transparency and policy-enforcement gap: a caller or platform may treat the skill as lower risk than it really is, while the script can still access secrets and transmit local document contents to a remote API.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill description emphasizes comparing two local documents, but the implementation uploads both files to a remote API for processing. This creates a data exfiltration and confidentiality risk because users may reasonably expect local-only handling of potentially sensitive documents such as contracts, PDFs, or images.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The script depends on bearer tokens from environment variables to send documents to an external service, which confirms networked processing not obvious from a 'local documents' framing. While reading credentials from environment variables is common, in this context it is security-relevant because it enables silent transmission of user files to a third party and may bypass user expectations about local-only behavior.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The default prompt instructs the agent to 'always execute' a bundled script for two local files without defining clear trigger conditions or requiring explicit user intent. This can cause unintended access to local documents and external API transmission, increasing the risk of overbroad tool use, data exfiltration, and surprising side effects when the user did not request document comparison.

Natural-Language Policy Violations

Low

Confidence: 84% confidence
Finding: The prompt hard-codes output behavior by directing the agent to return markdown directly when asked, rather than making output format and data disclosure conditional on user consent and task scope. In this skill, the markdown may contain sensitive diff content derived from local documents, so forced formatting/output behavior can encourage over-disclosure of document contents beyond the minimum necessary response.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/compare_to_markdown.js:8