Security audit

博客写作助手专业版

Security checks across malware telemetry and agentic risk

Overview

This blog-writing skill is not clearly malicious, but it asks for broad command, file, credential, API, and publishing authority without enough scoping or user control.

Install only if you are comfortable with a writing skill that can guide an agent to read and modify files, run shell commands, inspect environment configuration, use API credentials, and integrate with publishing workflows. Keep credentials narrowly scoped, avoid broad workspace access, and require explicit review before any publish, webhook, batch, or command-execution step.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The skill is presented as a blog-writing assistant, but these sections advertise broad file handling, API integration, information retrieval, and command execution capabilities that materially exceed that purpose. This mismatch increases the chance the agent will invoke powerful actions under an innocuous writing-related pretext, enabling overbroad access and unexpected side effects.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: Exposing Bash for a writing assistant violates least privilege because shell execution can read files, inspect the environment, and perform arbitrary local actions unrelated to drafting content. In agent environments, even without explicit malicious code, this expands the attack surface for prompt-induced command execution or abuse of nearby sensitive resources.

Context-Inappropriate Capability

Low

Confidence: 91% confidence
Finding: The instructions tell users to enumerate environment variables matching API, KEY, TOKEN, SECRET, or PROFILE, which normalizes secret discovery behavior unrelated to blog writing. Even though the sample masks values, listing secret-bearing variable names can still aid reconnaissance and encourage agents to inspect sensitive runtime context.

Context-Inappropriate Capability

Low

Confidence: 88% confidence
Finding: Generic instructions to configure API keys, initialize connections, and call interfaces are broader than the stated content-writing purpose and can cause the agent to handle credentials and external systems unnecessarily. This creates avoidable exposure of secrets and expands the blast radius if the skill is triggered by ordinary writing requests.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The activation wording is broad and overlaps with common writing requests, so the skill may trigger in many ordinary conversations without clear boundaries. Because the skill also declares powerful tools, ambiguous activation increases the risk of the agent selecting this overprivileged skill for tasks that do not need it.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.