Design Norm Quantity

• Outcome: Review
• Latest audit: May 29, 2026 · 9:31 PM UTC
• Version: 3.3.5

Overview

This is a construction cost-estimation toolkit, but it materially overstates its AI, BIM, and ±3% accuracy claims, so users should review it carefully before relying on it.

Install only if you are comfortable treating this as a prototype or heuristic estimating aid. Do not rely on its advertised ±3% accuracy, AI, neural-network, or BIM claims for bids, budgets, procurement, or investment decisions without independent professional validation. Run crawler or download scripts only when you intentionally want third-party data written to local storage.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (40)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill declares no permissions while its documented scripts indicate file read/write and network-capable behavior such as crawling, database access, downloading documents, and exporting reports. This is dangerous because it prevents informed consent and sandbox policy enforcement, allowing unexpected data access or exfiltration through capabilities that are not transparently declared.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared purpose is a quantity/cost estimation skill, but the manifest and description reference substantially broader behaviors including web crawling, local SQLite creation, file export, PDF downloading, report generation, CLI/test tooling, and independent international estimation modules. This mismatch is dangerous because reviewers and users may authorize the skill for a narrow estimation task while it performs broader data collection and filesystem/network actions outside that expectation.

Context-Inappropriate Capability

Low

• Confidence: 82% confidence
• Finding: Exposing /debug, /chain, and /rules can leak internal logic, rule ordering, and system behavior that are unnecessary for normal users. In an agent setting, this kind of introspection can help an attacker map decision paths, infer hidden assumptions, and craft inputs to bypass validation or manipulate outputs more effectively.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The README materially contradicts the published skill metadata: it documents v3.1.0 with ±10% accuracy, while the manifest advertises v5.0 with ±3% precision. This kind of specification drift can mislead users into making trust, procurement, or investment decisions based on capabilities the shipped skill does not actually provide.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The skill description markets QDV, MEG-Net, target-locking, and 8 AI algorithms, but the README describes a different approach centered on ratio tables, Monte Carlo simulation, SQLite calibration, and official-data crawling. This discrepancy is dangerous because users may rely on nonexistent analytical controls or validation methods, creating false confidence in the system's outputs.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The document explicitly states a composite precision of ±3.2% while simultaneously claiming it meets a ±3% target. In an estimation system, this kind of internal contradiction can mislead users into overtrusting outputs for bidding, budgeting, or procurement decisions, creating integrity and business-risk issues even though it is not code execution or direct data compromise.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The implementation roadmap says the ±3% target is a future objective, but earlier sections and the conclusion present it as a current capability and commitment. This mismatch can cause users to rely on undeployed or unverified functionality, making the skill context more dangerous because it is positioned as a high-precision professional estimation tool where inaccurate claims could influence financial decisions.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The skill metadata advertises QDV, MEG-Net, target-locking, and '8 AI algorithms,' but the file only shows rule-based formulas and validation logic without evidence of those advanced methods. This is dangerous because it can misrepresent the system's analytical basis, causing operators to assign unwarranted confidence to estimates or compliance claims in a domain with material cost consequences.

Context-Inappropriate Capability

Medium

• Confidence: 85% confidence
• Finding: The script performs outbound downloads from multiple third-party domains and writes the returned content directly to local storage without validation, integrity checking, or domain-governance controls beyond hard-coded URLs. In a skill whose stated purpose is estimation/valuation, this extra network capability increases attack surface: compromised hosts, poisoned PDFs, or unexpected content could be pulled into the environment and later trusted by users or downstream tooling.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The skill metadata promises an advanced ±3% AI-driven estimation system, but this file only performs simple rule-based calculations and a seeded Monte Carlo simulation. In a cost-estimation skill, such misrepresentation can cause users to place unjustified trust in outputs for budgeting, procurement, or engineering decisions, creating a safety and financial integrity risk even without classic code-execution behavior.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The module docstring and banners claim a 'measurement uncertainty system' and meaningful Japanese precision-method integration, but the implementation mainly contains static reference tables, summaries, and simple formulas without any true uncertainty-control or precision-management mechanism. This is dangerous because it can mislead operators into believing the system has methodological rigor and cross-framework validation that it does not actually provide.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The report explicitly states that inter-material correlations are modeled, but the Monte Carlo simulation samples each material independently and never applies the defined correlation matrix. This creates a misleading risk model: users may trust the reported confidence intervals and budget recommendations even though dependency risk is understated or distorted, which can lead to materially wrong planning decisions.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The skill metadata and module docstring market an industry-leading ±3% system using QDV, MEG-Net, target-locking, and 8 AI algorithms, but the actual file implements a much smaller handcrafted estimator set and even reports weaker precision targets such as ±8% to ±18%. This is dangerous because users may rely on materially overstated capabilities for cost estimation decisions, creating a trust and integrity failure that can drive financial loss or unsafe downstream planning.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The module documentation presents the component as a top-tier ML integration module with broad algorithm coverage and authoritative sourcing, but the code contains simplified local implementations and does not substantiate many of the stated capabilities. In a decision-support skill, this kind of specification drift is dangerous because it misleads operators about model rigor, validation status, and expected reliability.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The demo labels its output as a prediction test but returns hand-constructed values instead of calling the trained model, which can mislead users into trusting fabricated performance. In a pricing/estimation skill, this can drive unsafe business decisions and conceal that the model is nonfunctional or unvalidated.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The file markets a high-accuracy AI estimation system, but the training path does not implement real parameter updates and the demo does not perform genuine inference or validation. This creates a deceptive automation risk: operators may rely on materially incorrect cost estimates while believing they come from a validated model.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The code advertises a BIM-backed ±3% precision stage, but the implementation only returns a hard-coded confidence and error band without ingesting or validating any BIM inputs. In a cost-estimation skill, this can mislead users into treating speculative results as decision-grade outputs, creating substantial financial and operational risk.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The implementation assigns ±3% precision and 95% confidence as constants rather than computing them from model performance, calibration data, or project-specific evidence. This creates a false assurance mechanism that may cause downstream users to rely on the estimate for procurement, budgeting, or contracting decisions under materially inaccurate assumptions.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The result metadata is internally inconsistent: the improvement path marks BIM auto-quantity as pending, while the returned result sets phase 5 and may state that ±3% precision has already been achieved. Such contradictory status reporting can confuse users and conceal that the final validation step has not actually occurred.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The implementation materially contradicts the skill metadata and advertised capabilities: the manifest promises a ±3% v5.0 system using QDV, MEG-Net, target-locking, and multiple AI algorithms, while this file is a separate ±8% heuristic estimator with static tables and simple weighted logic. In a decision-support or procurement context, this can mislead users into relying on claimed accuracy and model sophistication that do not exist, causing unsafe business decisions and undermining any trust or review controls based on the manifest.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: Round 10 claims to validate precision and declare target attainment, but the code simply hard-codes `precision = 8.0` and prints a success status unconditionally. This creates a false assurance mechanism: operators may believe the estimate has been empirically validated when no accuracy check against ground truth, confidence interval threshold, or holdout benchmark is performed.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The skill metadata and module header advertise a v5.0 system with QDV, MEG-Net, target-locking, and 8 AI algorithms, but the implementation is only a v4.0 estimator using heuristic, ML, Bayesian, and optional BIM components. This is a security-relevant integrity issue because downstream users or agents may rely on claimed capabilities, precision, or controls that are not actually present, leading to unsafe automation or materially incorrect decisions.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The code claims the highest-precision mode uses BIM plus real-time market data, yet no real-time data source is fetched, validated, or incorporated anywhere in the implementation. In a pricing or estimation workflow, this can mislead operators into trusting stale or synthetic outputs as live-informed results, creating decision risk and possible financial harm.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The file prominently promises a ±3% precision goal, but the implementation later derives much looser effective precision from design stage, including ±15% for scheme design and ±30% for conceptual estimates. In a cost-estimation skill, this mismatch can mislead users into overtrusting outputs for budgeting, bidding, or procurement decisions, creating material financial and operational risk even though it is not a code-execution issue.

Intent-Code Divergence

Low

• Confidence: 87% confidence
• Finding: The report text states that the computed overall precision is the target precision rather than clearly describing it as a modeled or estimated uncertainty. That framing can cause downstream users to interpret a planning heuristic as a guaranteed accuracy bound, which is especially risky in a professional estimation context where reports may be reused as decision support artifacts.

VirusTotal

67/67 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.