Security audit

Python 环境工具基础版

Security checks across malware telemetry and agentic risk

Overview

This Python environment helper has useful local commands, but its network, callback, and API-key instructions are unclear and conflict with its privacy claims.

Review before installing. Use it only for Python environment tasks, and do not provide callback URLs or API keys unless you understand exactly what data will be sent and where. Confirm before letting it recreate virtual environments, install packages, or run project commands.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 87% confidence
Finding: The skill is presented as a local Python environment manager, but it also accepts a callback_url and implies remote notification behavior. This expands the trust boundary beyond local-only execution and can cause users or agents to send project metadata or execution results to external endpoints without a clear security warning.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The file claims FREE-version data remains local and is not uploaded, yet later states that some functions require network access to external APIs. This is a direct contradiction that can mislead users into exposing environment details, dependency metadata, or secrets under a false expectation of privacy.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: A Python venv/pip helper does not inherently need external APIs or API key handling, so introducing them without a strong functional justification increases attack surface and raises the risk of credential exposure. In an agent setting, this can normalize collecting secrets or making network calls unrelated to the stated task.

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: The document asserts that all FREE-version data is stored locally and never uploaded, while other sections describe API/network-dependent behavior. False privacy assurances are dangerous because they reduce user caution and may lead to unintended disclosure of local project state, configuration, or sensitive tokens.

Vague Triggers

High

Confidence: 89% confidence
Finding: The trigger condition says to use the skill for data analysis, reporting, statistics, and visualization, which is unrelated to Python environment management. Overbroad triggers can cause an agent to invoke this skill in inappropriate contexts, increasing the chance of unnecessary shell execution, environment modification, or data exposure.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The skill can execute shell commands and modify local environments, but the description does not clearly warn users about these side effects. In agent workflows, missing execution and modification warnings can cause silent changes to project state, package sets, or interpreter configuration.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.