Security audit

RiskForge

Security checks across malware telemetry and agentic risk

Overview

RiskForge is a coherent code-risk review skill, but it requires uploading detailed reports and local metadata to an external HTTP service without clear opt-in control.

Review before installing. Use this only if you are comfortable with generated code-risk reports and repository metadata being sent to ai-testcase.jd.com over HTTP. Avoid running it on proprietary, regulated, or sensitive repositories unless network egress is blocked or the upload behavior is removed/changed to explicit opt-in.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (22)

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: A mandatory external upload step is unrelated to the core task of local code-risk analysis and creates unnecessary data exposure. Because reports may contain vulnerability details, repository structure, and internal paths, forced transmission materially increases confidentiality risk.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The skill expands from analysis into writing unit tests into the repository and executing them, which changes files and runs code in the user's environment. That broadened capability increases the chance of unintended modification, CI disruption, or execution of unsafe generated code beyond the user's expected scope.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The manifest suggests unit-test suggestions, but the body requires generating and writing test code into the project. This discrepancy is dangerous because users may authorize advisory analysis while the skill performs repository modifications with lasting effects.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The manifest frames the skill as report generation, but the documentation adds required remote transmission of the full report to a specific HTTP API endpoint. Hidden egress is particularly risky in a code-review context because reports can contain sensitive vulnerability descriptions, repository metadata, and internal paths.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The document describes automatic upload of generated reports to an external platform, which expands the skill from local analysis into outbound data transfer. In a code-review and financial-risk context, reports may contain sensitive code, findings, file paths, repository URLs, and operational details, so silent auto-upload creates a real exfiltration and scope-expansion risk.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The documented payload includes full report content plus tester identity, repository URL, absolute file path, function name, and issue details. That combination can expose sensitive source locations, internal infrastructure metadata, and potentially proprietary or regulated financial testing content to a remote system.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: A remote HTTP upload capability is documented even though the skill's stated purpose is risk analysis and quality review, not external publishing or synchronization. In this context, undocumented network egress is dangerous because users may expect local analysis while the skill transmits artifacts to an external service.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The script is presented as a local code-risk analysis/quality-gate tool, but it is configured to upload full report contents and associated metadata to an external service using plain HTTP. Because these reports can contain proprietary source analysis, file paths, repository URLs, and potentially sensitive findings, transmission over unencrypted HTTP creates both confidentiality and integrity risk.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The code collects the local git username and falls back to the system account name, which is not necessary for basic report parsing and increases privacy exposure. In combination with repository/path collection and remote upload, this creates avoidable leakage of user and environment metadata that may identify internal personnel, hosts, or projects.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The skill requires uploading generated reports to an external platform without a clear, prominent warning to the user at invocation time. In this context, reports may include sensitive security findings and internal repository metadata, so silent or assumed disclosure creates a substantial data-leak risk.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill instructs writing generated tests into the project without clearly warning that repository files will be modified. Unexpected writes can introduce noisy commits, break builds, or overwrite local work in environments where the user expected read-only analysis.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The trigger list is broad and semantically overlapping (e.g., generic terms around dependency impact, logic defects, and code change analysis), which can cause the skill to activate outside narrowly intended contexts. In an automated code-review or risk-gating workflow, unintended invocation can lead to irrelevant analysis, over-collection of code context, and potentially unsafe delegation decisions based on the wrong skill.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger phrases are broad enough to match many ordinary development or review requests, which can cause this skill to activate outside its intended Git-diff extraction context. In an agentic workflow, overbroad activation can route unrelated repository or code-review tasks through this skill, creating incorrect tool selection, unintended repository analysis, and noisy or misleading downstream security conclusions.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The activation conditions are underspecified and say the skill should run whenever code change information or branch-difference analysis is needed, without clear boundaries or prerequisites. In a multi-skill agent system, this ambiguity increases the chance of accidental invocation, which can expose repository metadata unnecessarily, interfere with intended workflow routing, or produce incomplete analysis when the request did not actually supply a valid diff context.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The trigger list is broad and overlapping for a manifest-like header, which can cause unintended activation of this validator in contexts that only loosely mention risk validation concepts. In an agentic workflow, accidental invocation can misroute tasks, override expected control flow, or apply validation behavior where it was not intended, increasing operational and review risk even if it does not directly enable code execution.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: Overly broad trigger conditions can cause the skill to activate during ordinary code-review tasks outside its intended runtime-exception scope. In an agentic workflow, unintended invocation can misroute analysis, overwrite safer skill selection, and produce incorrect or incomplete security judgments that operators may trust.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: A trigger list made of generic phrases increases the chance of accidental or adversarial invocation in unrelated contexts. In multi-skill agent systems, this can let the skill capture prompts it is not best suited for, reducing analysis fidelity and potentially suppressing more appropriate security or compliance checks.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The document describes automatic HTTP upload of full test reports and metadata without any user-facing warning about transmission, privacy, or sensitivity. Because this skill operates on financial AI/code review material, the uploaded content may include confidential business logic, vulnerabilities, internal paths, and employee identifiers, making undisclosed transmission particularly risky.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The usage section lists a very broad trigger condition of merely '代码变更', which can cause the skill to activate for almost any code change rather than only when the user explicitly asks for unit test generation. In an agentic workflow, this can lead to unintended file modifications, unnecessary tool execution, and policy bypass of user intent, especially because the skill also instructs editing existing test files and compiling tests.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The upload path sends the full report body plus derived metadata such as repository URL/path and tester identity to a remote endpoint without a user-facing confirmation step. In a code-review or financial-risk-analysis skill, the report content is especially likely to contain sensitive internal code references, security findings, business logic, and compliance data, making silent exfiltration materially dangerous.

Ssd 3

High

Confidence: 99% confidence
Finding: The skill specifies automatic extraction and external upload of repository URL, absolute file paths, tester identity, issue details, and full Markdown report content. In a security-analysis skill, that data can reveal internal architecture, vulnerability details, and sensitive organizational metadata, making unconditional disclosure highly dangerous.

Ssd 3

High

Confidence: 99% confidence
Finding: The workflow forces every report to be uploaded after generation, guaranteeing disclosure of collected analysis data regardless of sensitivity or user intent. This is especially dangerous for code-risk reports because they often contain exploit details, affected files, and remediation notes that should remain internal.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/generate-test-report.js:28