conspect

• Outcome: Review
• Latest audit: Aug 6, 2026 · 9:51 AM UTC
• Version: 0.1.0

Overview

This looks like a legitimate spreadsheet reporting skill, but it needs Review because it can automatically run local Python tooling, read business data, and persist many files without tight user control.

Install only if you are comfortable with an automated workflow that reads uploaded business spreadsheets, may analyze every sheet, runs bundled Python tooling, starts a local preview server, and leaves multiple derived files on disk. Use it in a dedicated project folder, review generated HTML before sharing, and avoid sensitive spreadsheets unless you can control output locations and retention.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (28)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill clearly instructs the agent to read and write files extensively, including creating many artifacts under `.agent/harness/`, but it does not declare corresponding permissions or present them as an explicit capability boundary. This creates a transparency and consent problem: users or orchestrators may invoke it believing it is lower-privilege than it really is, increasing the risk of unintended filesystem modifications.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The execution guide substantially broadens the skill from Excel report rendering into a general-purpose orchestration framework with mandatory state files, baton management, routing, retries, and sub-agent coordination. This increases the skill's authority and behavioral surface area well beyond the declared purpose, creating more opportunities for unintended file operations, user-confusing autonomy, and misuse of the agent as a workspace controller rather than a bounded reporting tool.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skill instructs the agent to discover and execute local code via `glob **/conspect_tools/run.py` and `python run.py ...`, including path selection heuristics that may choose arbitrary local copies. This is dangerous because it delegates trust to unverified code found in the workspace or filesystem, enabling execution of attacker-planted or stale tooling against user-provided files.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The added insight-generation stage expands the skill into AI-driven business interpretation and extra feature/statistics processing beyond the advertised scope. Scope expansion matters because it causes the agent to perform additional data transformations and autonomous analysis that users may not expect or have consented to, increasing both privacy exposure and the chance of unsafe downstream actions.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: The guide requires extra output formats such as Markdown, HTML, PDF, and DOCX beyond the stated outputs, broadening file creation and persistence in the user's workspace. More artifact formats mean more disk writes, more dependencies, and more chances to leak sensitive data into unexpected locations or formats the user did not request.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The skill explicitly instructs the agent to read raw data samples directly after CLI analysis, expanding access beyond the declared tool-mediated workflow. This increases the risk of prompt injection, accidental exposure of sensitive spreadsheet contents, and inconsistent handling of untrusted data because the model is asked to interpret attacker-controlled raw content directly.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The skill explicitly instructs the agent to launch a local HTTP server for preview and then stop it afterward. Even though this is framed as a convenience for rendering validation, it expands the skill from file generation into local network service management, which increases attack surface and can expose generated content or occupy ports unexpectedly if cleanup fails. In this report-generation context, that capability is not strictly necessary because HTML correctness can be validated without opening a listening service.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The skill can load arbitrary review context from multiple external files, which exceeds its stated Excel/report-rendering purpose and increases the chance of unintended access to unrelated local documents. In an agent setting, this broad file-ingestion surface can be abused to read sensitive artifacts under the guise of 'review context' loading.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill mandates creating directories and writing baton files immediately on activation, before substantive user interaction, without a clear user-facing warning or consent model for workspace modification. Silent writes to the user's project are dangerous because they can alter repositories, clutter workspaces, and normalize unauthorized file mutation by the agent.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill directs broad CLI/subprocess execution over user-supplied files without a clear safety notice, trust boundary explanation, or consent checkpoint. Combined with the dynamic tool-discovery behavior, this exposes users to arbitrary local code execution and opaque processing of potentially sensitive spreadsheets.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The implementation/report phases direct the agent to generate and save multiple artifacts, including HTML, PDF, and DOCX, without explicit disclosure that sensitive spreadsheet contents may be persisted to disk in several derived formats. This increases data exposure, leaves residual artifacts, and may surprise users who expected an in-chat or limited-output workflow.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger phrases are broad, generic business terms such as '数据分析', '周报', and '生成图表', which can easily match ordinary user requests that may not actually intend to invoke this skill. In an agent environment, this increases the chance of unintended activation, causing the system to process uploaded business data or generate outputs in a workflow the user did not explicitly choose.

Vague Triggers

High

• Confidence: 94% confidence
• Finding: The activation rule is extremely broad and says the skill must immediately execute whenever a user expresses general data-analysis or report-generation intent. In a multi-skill environment, this can hijack ordinary requests, trigger unrequested file operations, and cause the agent to follow the skill's internal workflow instead of the user's narrower intent.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The quick-start examples use generic natural-language prompts like 'analyze this business data' and 'make a weekly dashboard,' which reinforce overbroad triggering without guardrails. This raises the chance of accidental activation and unintended execution, especially because the skill also mandates automatic progression and artifact creation.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill mandates automatic creation of baton, analysis, QA, report, and other files immediately upon activation, without first warning the user or obtaining consent for filesystem writes. Because activation itself is broad, this compounds into a meaningful risk of surprise persistence, workspace pollution, and unintended handling of potentially sensitive data.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill instructs the agent to write checklist and status updates into workspace baton files and later generate report artifacts, but it does not require any user-visible consent or warning before modifying files. In an agent setting, silent workspace mutation can be abused to tamper with orchestration state, overwrite artifacts, or create misleading downstream inputs for other agents.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The skill hard-codes Chinese-named output copies regardless of user preference, which overrides normal user control over output language and naming conventions. While not directly enabling code execution or data exfiltration, it can create policy-compliance, usability, and workflow risks in multilingual or regulated environments where filenames must match user or system expectations.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The file defines fixed Chinese filenames for every output format, forcing localization behavior without verifying user consent or downstream compatibility. This can break integrations, overwrite expected naming schemes, or violate enterprise document-handling requirements where filenames, language, or character sets are constrained.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: The `custom` section directly appends `section.get("html", "")` into the output without sanitization, enabling arbitrary HTML and likely JavaScript injection in the generated dashboard. In this skill's context, layouts may be AI- or user-derived, so this becomes an XSS/code-in-browser risk that can execute when the report is opened, potentially stealing data or manipulating the rendered report.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: save_report writes attacker- or model-controlled content directly to disk using a user-provided filename, with no visible path validation, overwrite protection, or runtime disclosure. In an agent workflow, this can enable silent filesystem modification, clobbering of existing files, or placement of deceptive artifacts in unexpected locations.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: save_with_chinese_name performs both file write and copy-like operations, increasing the filesystem side effects while still taking caller-controlled content and filenames. This makes it easier for an agent to create multiple persistent artifacts without clear disclosure, potentially confusing users or overwriting nearby files depending on Exporter behavior.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: save_index writes an index file to disk from caller-supplied data and filename without visible safeguards. Although lower impact than report content writes, it still enables silent persistence and possible overwrite of local metadata files in an agent environment.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The FAQ states that oversized uploads are automatically sampled, retaining only part of the dataset, without emphasizing that downstream analysis may no longer represent the full source data. In a business reporting skill, silent or weakly signaled truncation can produce materially misleading charts, decisions, or compliance outputs while appearing authoritative.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The FAQ says the system automatically loads all sheets in an uploaded Excel file, which can ingest unrelated, sensitive, or hidden-tab data beyond the user’s intended scope. In this skill context, broad automatic ingestion increases privacy and data-minimization risk because reports may incorporate confidential worksheets the user did not mean to analyze.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The document states that after each phase the main agent will automatically invoke the AI review agent, but it does not define clear user consent, scope limits, or gating conditions for when this child agent may access files and run. In an agent workflow, ambiguous auto-activation can cause unintended execution on sensitive context, increase attack surface, and make behavior hard for users to predict or control.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.