Security audit

Industrial Park Investment Assistant

Security checks across malware telemetry and agentic risk

Overview

The skill is a plausible business assistant, but it needs Review because it can automatically store and sync customer, property, and channel data while making inconsistent local-only safety claims.

Install only after reviewing the data-flow and automation settings. Treat it as a CRM-like tool: assume customer/contact/property/channel data may be written locally and synced to Tencent Docs, disable or avoid automatic voice/conversation updates unless your workflow accepts that risk, and do not rely on generated enterprise or competitor intelligence without manual verification from authoritative sources.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (26)

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The security statement explicitly claims there is no network sending logic and that all work is local, yet the skill repeatedly directs use of Tencent Docs MCP and WebSearch. This contradiction can cause users to disclose sensitive customer, tenant, or business data under false assumptions about locality and data exposure.

Intent-Code Divergence

High

Confidence: 95% confidence
Finding: The skill says it is not a CRM and does not manage customer data, but many sections instruct automatic creation and updating of customer, channel, and room records. This is a direct contradiction that can mislead users into sharing sensitive business information without realizing persistent records will be created or modified.

Description-Behavior Mismatch

Medium

Confidence: 98% confidence
Finding: The script presents itself as retrieving real-time enterprise intelligence from Qichacha, but every data-returning function populates hardcoded mock values. Because the results are then saved and displayed as if they were live data, users may make investment, outreach, or approval decisions based on fabricated information, which is a security-relevant integrity failure in this business context.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: Comments, function names, and user-facing output claim that the script is fetching live enterprise data even though the implementation only sleeps and returns synthetic records. In a招商/investment assistant, this increases the risk that operators trust stale or fictional data during prospect qualification, pricing, or executive reporting.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The function claims to fetch real-time enterprise data but only sleeps and injects hard-coded mock values. In a sales/investment assistant, this can mislead users into trusting fabricated business intelligence as current fact, resulting in bad decisions and inaccurate external communications.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The script builds core briefing sections from invented enterprise, funding, decision-maker, and site-expansion details rather than validated records. Because this skill is positioned as a fact-recording, task-driving, timeliness-aware assistant, fabricated content can directly cause users to act on false commercial intelligence and present inaccurate claims to customers.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The competitor analysis and interception scripts are generated from static invented competitor names, pricing, and positioning. In this business context, false competitive claims can misinform negotiations, create reputational/legal risk, and undermine the manifest's promise of knowledge-base-backed decision support.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The script claims to generate a briefing based on enterprise/customer data, but most of the briefing content is hardcoded simulated intelligence rather than derived from the loaded customer record. In a business decision support context, this can mislead users into treating fabricated financing, hiring, expansion, and decision-maker details as factual, causing bad commercial decisions and possible reputational or legal issues if repeated to customers.

Context-Inappropriate Capability

Medium

Confidence: 99% confidence
Finding: `project_id` is taken directly from the command line and joined into a filesystem path without validation or normalization checks. An attacker or careless user can supply values such as `../../...` or absolute-like path segments to create directories and write `config.json` outside the intended workspace, causing arbitrary file creation/overwrite within the privileges of the executing user.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The function claims to generate risk warnings from interaction history, but it only returns generic placeholder messages and performs no actual analysis. In this skill’s business context, users may rely on the output to prioritize follow-up and assess deal risk, so misleading pseudo-analysis can cause missed warning signs, poor decisions, and false trust in automation.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The main workflow states customer data should come from records, but it uses hardcoded mock stage, duration, and interaction history values. In an operational sales-assistant skill, this can generate materially wrong recommendations for real customers, leading users to act on fabricated state while believing it reflects live records.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The script claims recommendations come from a 'real-time park room database', but the code actually uses a hardcoded sample dataset. In an investment/leasing assistant, this can mislead operators or customers into acting on stale or fictitious availability, creating operational and trust risks.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The broader skill promises multi-source knowledge integration and time-sensitivity checks, but this script performs recommendations only from static local sample data and does not enforce any 'pending update' or manual verification gate. In this business context, that increases the chance of presenting outdated inventory or pricing as actionable guidance.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: Broad trigger phrases for automatic behavior can activate on ordinary conversation, causing unintended searches, imports, syncs, or state changes. In a skill handling customer, property, and channel data, accidental activation can lead to privacy issues, incorrect records, or unnecessary external calls.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The phrase '按这个配置' is highly generic and likely to occur in normal conversation, yet it is mapped to powerful behavior such as reading Tencent Docs links, parsing content, and creating databases. That creates a real risk of unintended configuration changes or data ingestion.

Vague Triggers

High

Confidence: 97% confidence
Finding: Automatically extracting and writing customer records whenever the user merely mentions customer-related information is unsafe because casual discussion can become persistent storage without informed intent. This is especially sensitive here because the data includes company names, contacts, phone numbers, deal stages, and follow-up history.

Vague Triggers

High

Confidence: 98% confidence
Finding: The voice-input rules explicitly state that no special trigger words are needed for channel, customer, and property updates, meaning natural conversation can directly mutate records. In mobile and speech contexts, recognition errors are common, so this greatly increases the risk of silent data corruption, unintended writes, and disclosure through remote sync.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill invites users to upload files, screenshots, and structured business materials for automatic parsing and storage, but does not prominently warn that those contents may be written into local databases and synchronized to remote Tencent Docs. Users may therefore provide sensitive tenant, customer, and channel information without meaningful notice.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: Automatic policy search and proactive push are triggered by customer industry mentions, but there is no clear warning that external web queries will be performed based on user-provided business context. Even if only industry keywords are searched, this can still expose commercial context or create user surprise about off-box network activity.

Natural-Language Policy Violations

Medium

Confidence: 92% confidence
Finding: The document makes an absolute privacy/security claim that 'all knowledge-base data is stored locally and will not be sent to any server' while also supporting Tencent Docs as a deployment mode. That statement is misleading because Tencent Docs inherently stores and serves data remotely, which can cause operators to make unsafe trust decisions and upload sensitive business data under false assumptions.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The script persistently stores collected enterprise profiles under a local workspace path without warning the user, obtaining consent, or offering retention controls. Even if the current dataset is mock data, the intended production behavior is to collect business intelligence about real companies, so silent persistence can create confidentiality, compliance, and data-governance risks.

Missing User Warnings

Low

Confidence: 81% confidence
Finding: The script automatically writes a customer analysis report containing potentially sensitive business information to a persistent local path under the user's home directory without explicit consent or controls. In a CRM/investment-assistant context, this increases the risk of unintended data retention, disclosure to other local users/processes, and accumulation of sensitive customer intelligence outside governed storage.

Missing User Warnings

High

Confidence: 90% confidence
Finding: The SQLite save path performs an unconditional full-table DELETE before reinserting records, making the operation destructive and non-atomic from a data-integrity perspective. If invoked with malformed, partial, or attacker-influenced input, it can wipe business-critical customer, pricing, or channel data, which is especially risky in this assistant because it supports operational decision-making across multiple projects.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The code writes proposal content containing customer and commercial information to disk automatically without any explicit user notice, retention control, or access restriction. In this skill context, proposals may contain tenant names, customer identity, pricing, and negotiation details, so silent persistence increases the risk of unintended disclosure through shared workspaces, backups, or later local access.

Missing User Warnings

Low

Confidence: 92% confidence
Finding: The script explicitly directs an operator or AI to invoke a live Tencent Docs MCP read during testing, but the prompt only says the tool must be configured and does not clearly disclose that real remote data may be accessed and surfaced as part of the test. In a sales/investment assistant context that handles customer, property, channel, and project data, this can lead to unintended access to potentially sensitive business data during what appears to be a simple performance test.

VirusTotal

VirusTotal engine telemetry is currently stale for this artifact.

View on VirusTotal

Static analysis

No suspicious patterns detected.