Security audit

data-viz

Security checks for vulnerabilities and agentic risk

Overview

The skill does offline chart generation, but it also includes a broad persistent learning module that records activity and preferences beyond a simple visualization workflow.

Review before installing. The charting function is local and offline, but the self-learning component keeps persistent local records of operations, notes, errors, and preferences. Install only if you are comfortable with that retention, and avoid passing sensitive dataset details into learner notes unless the skill is revised to add clear opt-in, scoping, and deletion controls.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill advertises file-producing behavior (`--out <输出目录>`, generating SVG/HTML/JSON outputs) but does not declare corresponding write permissions. Undeclared file write capability weakens policy enforcement and user visibility, and in an agent ecosystem can allow writes to unexpected locations or overwrite local artifacts if activation is automatic.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill is presented as a visualization utility, but the embedded 'learner' behavior records operations, results, and details, persists learned patterns, and performs cross-skill analysis. This is a material behavior mismatch that can lead to silent collection of user activity and data retention beyond what a user would reasonably expect from a charting tool.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: This file implements a generic cross-skill telemetry and self-learning module that is materially unrelated to the declared data-visualization purpose. In a skill ecosystem, hidden or undeclared cross-cutting collection logic increases the risk of unauthorized data retention and capability creep, especially because it can be invoked by any skill and writes persistent state under user-controlled skill directories.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The code persistently stores preferences, notes, capabilities, and error telemetry in learned_patterns.json without any consent, minimization, or sensitivity controls. Free-form fields like note and preference values may capture sensitive user or workflow data, creating privacy and data-governance risk that exceeds the stated visualization use case.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger phrases are broad (`画个图`, `做个图表`, `dashboard`, `看分布`) and likely to match many ordinary requests without clear user intent to invoke this specific skill. Over-broad activation increases the chance the skill runs on unintended datasets, causing unnecessary file reads/writes and unexpected persistence via the learner component.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The usage examples describe common requests but do not define limits on when the skill should or should not activate. In context, that ambiguity is more dangerous because the skill also writes files and invokes a learner that records operation metadata, making accidental invocation more privacy- and integrity-relevant than for a read-only tool.

Static analysis

No suspicious patterns detected.