Security audit

报告工具包-免费版

Security checks across malware telemetry and agentic risk

Overview

This reporting skill is mostly coherent, but it gives agents broad execution and database-related authority without enough scoping or confirmation.

Review this skill carefully before installing. Use it only with explicit report configurations you trust, avoid command data sources unless the exact command is harmless and necessary, confirm any scheduled or email delivery action before it runs, and keep API/SMTP credentials in a controlled environment rather than pasting secrets into shared or recorded terminals.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Context-Inappropriate Capability

High

Confidence: 95% confidence
Finding: The skill explicitly supports a `command` data source and demonstrates running shell commands such as `df -h`, which expands the skill from report generation into arbitrary command execution. In an agent context with `exec` and `write` permissions, user-controlled report configs could be abused to run unintended local commands, access sensitive files, or chain into persistence/exfiltration behaviors.

Intent-Code Divergence

Medium

Confidence: 72% confidence
Finding: Although the document says credentials are not stored in config files, its usage pattern still encourages entering/exporting live secrets in a shell session, which can leak via shell history, process inspection, terminal logs, or shared session capture. This is a weaker issue than hardcoding secrets, but it still creates avoidable credential exposure risk.

Vague Triggers

High

Confidence: 90% confidence
Finding: The trigger condition says to use the skill for database operations, SQL queries, and storage management, which does not match the skill's stated purpose of report generation. This ambiguity can cause an agent to invoke the skill in overly broad contexts and combine its `read`/`write`/`exec` capabilities with tasks outside its intended scope, increasing the chance of unsafe actions.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The statement that natural-language instructions can trigger the scenario without precise constraints makes invocation overly permissive. In an autonomous agent setting, broad natural-language activation increases the risk that ambiguous user requests cause report execution, file writes, network access, or downstream command execution without sufficient confirmation.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The skill advertises email delivery of reports without warning that report contents may be transmitted to external systems and retained by mail providers or intermediate infrastructure. If reports include financial summaries, activity logs, or API-derived content, this can create unintended disclosure outside the local environment.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The skill advertises email delivery of reports without warning that report contents may be transmitted to external systems and retained by mail providers or intermediate infrastructure. If reports include financial summaries, activity logs, or API-derived content, this can create unintended disclosure outside the local environment.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.