Security audit

品牌GEO分析

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly coherent for brand AI-search analysis, but its report can falsely state that sentiment is 100% positive even when negative results exist.

Review this skill before installing if you rely on the generated report for business decisions. Avoid submitting confidential brand plans or unreleased product names, protect the RedFox API key, and verify sentiment metrics manually until the hardcoded positive-rate summary is fixed.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill instructs the agent to use environment variables, read and write local files, and make network requests, but it does not declare those permissions explicitly. This creates a capability-transparency gap: users and policy systems cannot easily understand that the skill will access secrets, contact third-party services, and persist data locally. In this context the behavior is expected for the workflow, but the lack of declaration still weakens consent and review controls.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The summary HTML hard-codes '正面率 100%（无负面评价）' instead of deriving it from the actual sentiment counts. This can misrepresent analysis results and cause users to make business or reputational decisions based on false data, undermining the integrity of the report.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The README states that the tool automatically submits brand/category questions to Doubao, Kimi, and DeepSeek, but it does not clearly warn users that their inputs and generated queries will be transmitted to third-party AI services. This creates a privacy and data-governance risk because users may unknowingly submit sensitive business information, client names, unreleased products, or internal strategy terms to external platforms with separate retention and logging policies.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill sends user-supplied brand names, competitor lists, and generated questions to external AI/search platforms, but the documentation does not clearly warn users that this data will be transmitted to third parties. That can cause unintended disclosure of commercially sensitive research topics, campaign plans, or internal brand-monitoring objectives. The context makes this more significant because bulk submission to multiple providers amplifies the exposure surface.

Missing User Warnings

Low

Confidence: 86% confidence
Finding: The skill tells users to place an API key in config or environment variables but does not warn that the credential is sensitive or advise against storing it in shared shells, repos, logs, or generated files. This omission can lead to accidental credential exposure and unauthorized use of the external service. The risk is moderate-to-low here because the text does not directly exfiltrate the key, but it normalizes unsafe handling.

Missing User Warnings

Low

Confidence: 81% confidence
Finding: The workflow writes raw third-party responses, derived analysis, and an HTML report to local files without warning that these artifacts may contain sensitive business inputs, external content, or reputational assessments. If stored in shared workspaces or attached elsewhere, they can leak internal research or proprietary monitoring results. The skill context increases relevance because brand-analysis outputs may be commercially sensitive even if they are not personal data.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.