Security audit

device-operations

Security checks across malware telemetry and agentic risk

Overview

The skill openly targets device and social-account automation, but its broad control over messages, posts, apps, screenshots, and self-learning state needs careful review before installation.

Install only if you intentionally want an external MCP server to control Android devices and social accounts. Before use, inspect the MCP server implementation and config, restrict it to test devices or limited accounts, require explicit confirmation before sending messages, publishing content, installing apps, receiving funds, or taking screenshots, and review how screenshots, cookies, account data, and self-learning records are stored and deleted.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: This is a clear mismatch because the declared purpose describes a complex automation/AI execution skill, but the provided code does not implement any device control, AI vision, routing, publishing, or multi-terminal orchestration. Instead, it performs local documentation validation tests against SKILL.md. The code's primary purpose differs materially from the description, and none of the advertised operational capabilities are present in the actual code.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The manifest description includes a generic trigger list such as "设备操作" and "AI视觉分析" without clear activation boundaries, exclusions, or negative examples. These phrases are broad enough to overlap with many ordinary requests, which could cause unintended invocation of this automation skill.

Missing User Warnings

High

Confidence: 95% confidence
Finding: The markdown describes automated sending of WeChat messages, batch multi-platform publishing, device control, app installation, and AI-driven fallback execution, but it does not warn users about potential impacts to accounts, posted content, messages, or device state. For markdown files, these user-data and system-integrity affecting behaviors require explicit disclosure so users understand the risks before use.

Vague Triggers

Low

Confidence: 78% confidence
Finding: This JSON file appears to define reference data for many device and social-platform operations, but it does not document what specific user requests or contexts should cause these capabilities to be invoked. For a manifest/reference file, the absence of explicit trigger boundaries or negative examples can make activation scope overly broad and increase the chance of unintended invocation.

Natural-Language Policy Violations

Medium

Confidence: 89% confidence
Finding: The natural-language labels, comments, examples, and limits in this file are written entirely in Chinese, which implies a fixed language/locale for the skill's interface and examples. There is no indication that users can choose another language or that the locale restriction is intentionally documented as region-specific.

Natural-Language Policy Violations

Medium

Confidence: 92% confidence
Finding: This Python file includes natural-language comments and docstrings in Chinese such as '自动生成', '验证', and '测试SKILL.md文件存在'. Under the policy, forcing a specific language without user opt-in can be a locale/language policy violation, and no opt-in or justification is present in the file.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.