Security audit

国际形势分析智能体

Security checks across malware telemetry and agentic risk

Overview

The skill appears to make and upload generated reports, but the upload step is not clearly disclosed or gated by user consent.

Install only if you are comfortable with generated reports being written to disk and potentially uploaded to an external service. Before use, confirm the destination, what content will be included, whether upload is optional, and how uploaded reports are retained or deleted.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill instructs the agent to generate a Word document and then upload it via an external uploader script, but it does not require explicit user consent or warn that data will leave the local environment. In a geopolitics analysis context, generated reports may contain sensitive prompts, proprietary research, or politically sensitive material, so silent file creation and external upload can cause confidentiality and data-handling risks.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.