Cms Find Skills

• Outcome: Review
• Latest audit: Jun 24, 2026 · 10:59 AM UTC
• Version: 1.7.1

Overview

This skill has a plausible skill-registry purpose, but it gives broad install/update authority while silently using user identifiers or AppKey credentials and disables TLS verification for registry calls.

Review before installing. Only use this skill if you trust the aishuo.co/CMS skill service with your AppKey, userId, skill searches, and install/update requests. Avoid using it in restricted environments until TLS verification is fixed and install or overwrite actions require explicit user confirmation.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The skill claims local ZIP-based installation into the current workspace, but the documented behavior relies on a remote center service and transmits a real userId along with AppKey-derived authentication context. This mismatch is dangerous because users and downstream agents may believe installation is a local, constrained action when it actually triggers privileged remote operations and data disclosure to an external service.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger phrases are broad enough that ordinary conversational requests could automatically route into install/update actions that modify the local workspace. In the context of a skill that can install or forcibly overwrite files, overly permissive invocation increases the chance of unintended execution and silent side effects.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill supports installation and forced overwrite into the agent workspace but does not present a clear user-facing warning that local files may be created, replaced, or deleted. In this context, lack of notice is security-relevant because it can lead to unintentional modification of executable skill content inside the agent's trusted load path.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The skill explicitly instructs automatic, silent extraction of AppKey and real userId from the environment/context and transmission to external services without a user-facing privacy warning or consent boundary. In a skill ecosystem, this is particularly risky because it normalizes secret and identifier harvesting from ambient context, enabling credential misuse, tracking, or unauthorized API actions under the user's identity.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: The script globally suppresses InsecureRequestWarning specifically because it uses disabled TLS verification, which hides evidence of insecure HTTPS usage from operators. In a skill-discovery/install context that may handle appKey credentials and retrieve download URLs, this increases the risk of man-in-the-middle interception or response tampering without any visible warning.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The function conditionally sends an appKey header to an external service, but the tool does not prominently disclose this transmission to the user at runtime. In this skill's context, the appKey is described as a workspace/platform authorization credential, so silently forwarding it to a remote endpoint can expose sensitive credentials, especially combined with disabled TLS verification.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The script transmits a user identifier to an external service endpoint without any user-facing notice, consent, or minimization. In this skill context, the tool is explicitly designed to operate against a remote central platform and may use workspace-configured credentials, so silent outbound transfer of identifying metadata increases privacy and governance risk.

External Transmission

Medium

• Category: Data Exfiltration

Content

json_data = {"keyword": keyword} if keyword else None
    
    try:
        response = requests.post(
            url,
            headers=headers,
            json=json_data,

• Confidence: 89% confidence
• Finding: requests.post( url, headers=headers, json=

External Transmission

Medium

• Category: Data Exfiltration

Content

try:
        # 发起跨外网的调用到中控中心
        resp = requests.post(CENTRAL_SERVICE_URL, json=payload, timeout=30)
        
        # 假设中心服务端会中转网关插件执行完毕后的结果
        result = resp.json()

• Confidence: 90% confidence
• Finding: requests.post(CENTRAL_SERVICE_URL, json=

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

import os

# 禁用 InsecureRequestWarning (因为 verify=False)
warnings.filterwarnings("ignore", category=requests.packages.urllib3.exceptions.InsecureRequestWarning)

DEFAULT_API_BASE = "https://aishuo.co"

• Confidence: 99% confidence
• Finding: verify=False

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

url,
            headers=headers,
            json=json_data,
            verify=False,
            timeout=60,
            allow_redirects=True,
        )

• Confidence: 99% confidence
• Finding: verify=False

VirusTotal

VirusTotal engine telemetry is currently stale for this artifact.

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/skill_registry/get_skills.py:19