Security audit

效率助手 v1 基础版

Security checks across malware telemetry and agentic risk

Overview

This productivity skill is mostly coherent, but it asks for broad shell access and mixes local-only privacy claims with network/API and callback behavior that users should review carefully.

Install only if you are comfortable giving this skill general command execution in the agent environment. Avoid using it with sensitive notes, credentials, or broad workspace access until its local-only claims are clarified, callback/network behavior is limited, and secret-checking instructions are narrowed.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Intent-Code Divergence

High

Confidence: 93% confidence
Finding: The skill claims that all data remains local and is never uploaded to the cloud, but other sections explicitly require external APIs, network access, and API key configuration. This creates a misleading trust boundary: users may expose sensitive notes, tasks, or summaries to remote services under the false assumption that processing is strictly local.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The manifest presents the skill as a simple personal productivity assistant, yet grants powerful tools including general command execution via exec. That mismatch is dangerous because users or hosting agents may authorize the skill expecting low-risk note/task behavior, while the skill can execute arbitrary shell commands well beyond its stated purpose.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The documentation instructs checking environment variables matching API, KEY, TOKEN, and SECRET patterns, which encourages broad secret discovery unrelated to a basic productivity skill. In an agent context, this can normalize or trigger access to sensitive credentials present in the runtime, increasing the chance of accidental exposure through logs, summaries, or follow-on command execution.

Description-Behavior Mismatch

Medium

Confidence: 86% confidence
Finding: The skill is advertised as a local personal-efficiency helper, but the input format includes callback URLs and later sections allow external API/network use. This expands the skill's operational scope into remote communication, which can enable silent data egress or SSRF-like behavior if user-controlled URLs or external endpoints are contacted without strict validation.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The description omits a clear warning that the skill may execute shell commands through exec, despite exposing that capability in the manifest. This deprives users and orchestration systems of informed consent and makes the skill materially more dangerous because it appears low-risk while retaining high-impact execution power.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.