Alibabacloud Quickbi Smartq

• Outcome: Review
• Latest audit: Jun 25, 2026 · 6:51 AM UTC
• Version: 0.0.2

Overview

The skill matches its Quick BI analysis purpose, but it also auto-registers a device-linked user and stores persistent identifiers or credentials, so it should be reviewed before installation.

Install only if you are comfortable with Quick BI receiving uploaded files, questions, dashboard data, and report inputs. Before use, prefer providing your own scoped Quick BI credentials, review ~/.qbi/config.yaml and the workspace .qbi/smartq-chat/config.yaml, disable global saving where possible, and be aware that trial mode may create a persistent device-linked user record and generated dashboard skills may alter skill-center directories.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (58)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill declares broad capabilities to read environment variables, read/write files, make network requests, and invoke shell/Python tooling, but does not declare permissions or present user-facing trust boundaries. This is dangerous because the skill also handles credentials and persistent configuration, so undeclared powerful capabilities reduce transparency and make consent and review harder.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The documented purpose is data analysis, but the skill additionally describes automatic user provisioning, persistent device identification, injection of built-in trial credentials, global config persistence, and browser-driven local rendering. These hidden or under-emphasized behaviors expand the trust boundary significantly and can cause credential, privacy, and persistence risks beyond what a user would reasonably expect from a BI analysis skill.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: Deriving a device-unique identifier and auto-registering a trial user creates a persistent identifier and external account without explicit informed consent. That exceeds the stated analysis purpose and introduces privacy and tracking concerns, especially when tied to a home-directory configuration or reusable account state.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The skill says it does not perform unrelated tasks, yet it instructs the agent to modify persistent workspace and global configuration files and potentially sync credentials to the home directory. Persistent credential writes create confidentiality and integrity risk, especially if performed automatically or without clear user confirmation.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The module instructs the agent to generate an account identifier from a device-unique value, register the user through organization APIs, and persist the resulting userId into ~/.qbi/config.yaml. Those are side effects unrelated to merely answering a dataset query, create identity/provisioning actions without clear user consent, and introduce persistent state on the host that can outlive the session.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: A skill presented as querying authorized datasets also performs organization membership checks and may add a user via /organization/user/addSuer. That expands scope from read/query operations into identity-management changes, violating least privilege and risking unauthorized account provisioning in the tenant.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The workflow performs automatic organization user registration and persists credentials or identifiers into ~/.qbi/config.yaml, which exceeds the narrow purpose of analyzing an uploaded file. This introduces an unexpected side effect on the host environment and can create unauthorized accounts or leave durable state without clear user consent, increasing privacy and supply-chain risk.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: Documenting automatic account provisioning plus writes to a home-directory config establishes behavior outside the advertised analytics capability and causes persistent environmental changes. In an agent setting, this can silently enroll the local machine into an external service context and create durable authentication state that later tasks may unknowingly reuse.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The module states that when `user_token` is absent, it auto-generates an account identifier, registers a user through an organization API, and writes the resulting `userId` back to `~/.qbi/config.yaml`. That creates persistent side effects and identity/provisioning behavior unrelated to merely analyzing user-provided data, which expands scope and can surprise users or violate least-privilege expectations.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The loader embeds trial API key/secret placeholders and later auto-populates credentials when user-supplied credentials are absent. Even if intended for convenience, shipping built-in service credentials inside a client-side skill creates a shared-secret distribution problem: anyone with the package can extract and abuse the credentials, and the config loader silently changes authentication behavior without explicit user action.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The configuration-loading path triggers persistent writes of first-use tracking data into the global user config, which means a nominally read-oriented operation mutates state under the user's home directory. This can create privacy, auditability, and trust issues, and in shared or automated environments it may leave unexpected artifacts or alter future execution behavior without clear consent.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: This file implements stable device fingerprinting by reading Linux machine identifiers and persisting a cross-run device ID, which is unrelated to the stated Quick BI data-analysis functionality. In a skill that processes user files and data queries, this creates an unnecessary tracking primitive that can be used to correlate activity across sessions and datasets without clear user need or disclosure.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The utility automatically provisions a user identifier when none is present and stores that identifier in global configuration, creating persistent state and account linkage beyond the manifest’s stated data-analysis/document-processing scope. This can surprise users, weaken consent boundaries, and cause unintended tracking or cross-skill reuse of identity data.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The report-chat payload hard-enables web search via needWebSearch/useOnlineSearch, which expands data flow to external search contexts not described in the skill manifest. User prompts and attached resources may therefore be used in broader external retrieval flows without clear disclosure or opt-in.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The generator deliberately appends code that imports `trial_reminder` on every `config_loader` import, causing an automatic atexit hook to be registered in generated runtime code. This introduces hidden behavior unrelated to dashboard-skill generation, expands the runtime side effects of the generated skill, and creates a persistence-like execution path that users may not expect or consent to.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill supports uploading files, document parsing, and dashboard processing through Quick BI and remote OCR flows, but does not prominently warn users that their files, extracted contents, or URLs may be sent to external services. This creates a serious data-handling transparency problem, especially for potentially sensitive business documents and datasets.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill instructs the agent to write credentials into workspace and possibly home-directory configuration files, but this persistence is not surfaced as a prominent user warning. Storing API keys and tokens in predictable locations can expose secrets to other tools, users, or repositories if not carefully controlled.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill documents writing persistent state to ~/.qbi/config.yaml without a clear up-front warning to the user. Silent writes to global configuration can surprise users, leak identifiers across sessions, affect unrelated runs, and make rollback or auditing difficult.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: Automatic registration that writes to a global config file without an explicit user-facing warning is a transparency and consent failure. Users may not realize the skill is modifying ~/.qbi/config.yaml, persisting identifiers, or enabling future access to external services from the same environment.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The module instructs the agent to upload user-provided Excel/CSV files to external Quick BI APIs, but does not include a clear privacy or data-transfer warning to the user. This is risky because uploaded files may contain sensitive business or personal data, and users may assume analysis is local when it is not.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The skill mandates a pre-query action for every user question, regardless of whether the request actually needs dashboard access. This broad trigger increases unnecessary execution of privileged logic and remote API calls, expanding attack surface and enabling unintended credentialed network access even for innocuous prompts.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The embedded code loads API credentials and transmits them to a remote service as part of routine execution, but the skill provides no user-facing notice or consent mechanism. In a skill context, this is dangerous because it normalizes hidden credentialed network activity and could expose sensitive metadata or enable unintended external interactions on arbitrary user queries.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The instructions explicitly direct the agent to parse and write API credentials and, when a flag is set, persist them to a global config location, but they do not require an explicit user warning or confirmation before modifying files or storing secrets. In a skill that handles cloud API access, silent persistence of credentials increases the risk of unintended secret retention, broader credential exposure across workspaces, and configuration changes the user did not knowingly approve.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The workflow directs the agent to send user questions and potentially uploaded/file-derived content to an external SmartQ API using configured credentials, but it includes no requirement to obtain consent, minimize data, or warn users that their data will leave the local agent context. In a data-analysis skill, users may submit sensitive business data, so silent transmission to a third-party service creates a real privacy and compliance risk.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill explicitly states that if the user specifies a skill name, an existing skill with the same name will be automatically overwritten, and later notes that existing targets are auto-renamed to backups during regeneration. Performing destructive or state-changing filesystem actions without an explicit confirmation at execution time can lead to accidental replacement of trusted skills, confusing version drift, or persistence of unintended generated content in the skill center.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/dashboard/quickbi_openapi.py:188