Security audit

Truth Seeking Fact Check

Security checks across malware telemetry and agentic risk

Overview

The skill is a mostly coherent fact-checking tool, but it overstates privacy and verification guarantees while containing code that can send checked text to Brave Search when configured.

Install only after reviewing configuration. Do not submit sensitive or confidential text unless external datasources are disabled or you accept Brave Search receiving the query text. Treat blockchain verification results as advisory, not proof of authenticity, and enable timed checks only for text you are comfortable keeping in memory and rechecking in the background.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: The documentation promises that checked content is never uploaded to external servers and that all functions are offline, but elsewhere advertises blockchain verification and multi-source fallback that inherently imply external network access. This can mislead users into submitting sensitive content under false privacy assumptions, causing unintended disclosure to third-party services or public blockchain explorers.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The skill claims fully local, offline fact-checking while also describing external verification sources and blockchain URL validation. In a security-sensitive context, inaccurate claims about locality and data flow are dangerous because users may rely on the tool for confidential content, unaware that text or metadata could leave the host environment.

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: This is a true vulnerability because the function claims to verify blockchain evidence, but it never queries blockchain data or validates any authenticated on-chain payload. Instead, it extracts a hex string from the URL itself and treats a 10-character prefix match against the locally computed hash as successful verification, which is trivially forgeable and can produce false trust in tampered or unauthenticated content.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The module advertises common-sense evaluation as part of the core fact-checking logic, but the main `check()` flow never calls `_check_common_sense()`. This creates a trust and integrity gap: consumers may rely on a credibility score that appears to include a safety-relevant dimension when it does not, leading to systematically overstated confidence in results.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The skill metadata makes a strong privacy guarantee ('all processing runs locally' and 'no user content uploaded to external servers') while the implementation clearly initializes a DataSourceManager and advertises blockchain verification, both of which strongly suggest possible network-backed lookups. Even if some deployments use only local sources, the current claim is overbroad and can mislead users into submitting sensitive content under false assumptions, creating a privacy and trust risk.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The code sends the full user-provided query/sentence to Brave Search, which is an external third-party service, without any visible consent, minimization, or privacy gating in this module. In a fact-checking skill, user input may contain sensitive or personal data, so silent transmission creates a real privacy and data-handling risk even if the external endpoint is legitimate.

Unpinned Dependencies

Low

Category: Supply Chain
Content: # 求真 v1.21 Python依赖 # 适配2核2G环境，仅使用轻量依赖 requests>=2.31.0 beautifulsoup4>=4.12.0 lxml>=5.1.0 nltk>=3.8.1
Confidence: 95% confidence
Finding: requests>=2.31.0

Unpinned Dependencies

Low

Category: Supply Chain
Content: # 适配2核2G环境，仅使用轻量依赖 requests>=2.31.0 beautifulsoup4>=4.12.0 lxml>=5.1.0 nltk>=3.8.1
Confidence: 95% confidence
Finding: beautifulsoup4>=4.12.0

Unpinned Dependencies

Low

Category: Supply Chain
Content: requests>=2.31.0 beautifulsoup4>=4.12.0 lxml>=5.1.0 nltk>=3.8.1
Confidence: 96% confidence
Finding: lxml>=5.1.0

Unpinned Dependencies

Low

Category: Supply Chain
Content: requests>=2.31.0 beautifulsoup4>=4.12.0 lxml>=5.1.0 nltk>=3.8.1
Confidence: 96% confidence
Finding: nltk>=3.8.1

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.