Security audit

加密文件

Security checks across malware telemetry and agentic risk

Overview

This encryption skill requests sensitive file, command, and API capabilities but does not clearly limit how files, keys, commands, or external services are handled.

Review this skill before installing. It may be usable for encryption-related tasks, but only in a controlled workspace with non-production files unless the publisher clarifies command limits, external API behavior, API key use, file-write side effects, and how plaintext and keys are protected.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The skill is branded as an encryption-focused capability, but the '核心功能' statement describes generic workflow automation and intelligent decision support. This scope mismatch is dangerous because it obscures the real operational boundaries of the skill and can normalize broader actions than users expect, especially in a skill that also advertises exec/write capabilities.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The documented output format is a generic scoring/audit report rather than a concrete encryption result such as ciphertext location, key handling status, or operation metadata. Misleading output contracts can cause downstream agents or users to mis-handle sensitive files, trust incorrect success semantics, or compose the skill into workflows it was not intended to support.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The documentation says the skill is not for non-cryptographic network management, yet elsewhere it presents external API integration/network-adjacent capability. This inconsistency weakens user understanding of what the skill may connect to, increasing the risk of unintended data disclosure or unexpected outbound requests involving sensitive material like files, passwords, or keys.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: Claiming general external API integration is overbroad for an encryption skill and creates an unjustified channel for transmitting sensitive data. In this context, such capability is especially risky because encryption workflows often involve secrets, file contents, hashes, or key metadata that should not be sent to arbitrary external services.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: Advertising system command execution is disproportionate to the declared purpose and materially increases the attack surface of the skill. In an encryption-oriented skill with read/write access, exec enables arbitrary local operations that could expose plaintext, mishandle keys, overwrite files, or be repurposed beyond the user's expected security boundary.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill description does not clearly warn users that the skill can execute commands and write files, despite those permissions being declared. This omission is dangerous because users may invoke the skill expecting passive analysis, while it is actually capable of modifying the filesystem or running local commands in sensitive encryption workflows.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.