Security audit

Token经济学家(专业版)

Security checks across malware telemetry and agentic risk

Overview

This token-cost optimization skill needs review because it encourages shared prompt/response caching across sessions and team members without adequate privacy controls.

Install only if you are comfortable with token optimization features that may store and reuse prompt/response history. For team use, disable sharedCache by default or require explicit admin controls for user isolation, redaction, retention, deletion, and outbound alerts. Treat the model-routing sample as needing correction before relying on it for important work.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The skill extends beyond token optimization by instructing network connectivity checks and integrating outbound webhook alerts. In an agent with exec and network-capable environments, this can prompt unintended external communication or reconnaissance-style behavior unrelated to the declared purpose, increasing the attack surface and risk of data egress.

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: The documented router logic is internally inconsistent: the code shown returns the simple model at the high-complexity threshold while the FAQ claims complex tasks route to GPT-4o. In a security-sensitive or correctness-sensitive workflow, this silent downgrade can cause poor reasoning on complex tasks, leading to unsafe outputs, flawed code, or incorrect operational decisions while users believe stronger review is being applied.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The FAQ claims shared cache data excludes user identity information, but the skill also describes team-level cost analysis, per-user budget allocation, and shared-cache behavior that imply user-associated tracking. This contradiction can mislead operators into underestimating privacy exposure, resulting in retention or sharing of user-linked query/response history without appropriate controls.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: Overly broad trigger phrases can cause the skill to activate on ordinary user requests not intended for token-economist behavior. In an agent with read/write/exec tools, accidental invocation can redirect workflows, apply unwanted transformations, or expose operational features in contexts where the user did not request them.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill promotes cross-session and cross-user caching together with Slack alerting but does not prominently warn that prior prompts, responses, or usage data may be retained and disclosed across sessions or external systems. This creates a real privacy and confidentiality risk, especially in team or enterprise environments where sensitive prompts may be reused or forwarded outside the original context.

Ssd 3

Medium

Confidence: 98% confidence
Finding: Cross-session and cross-user semantic caching instructs storage and reuse of prior queries and responses across different contexts. Because cached natural-language content may contain secrets, internal code, business data, or personal information, reuse across sessions or users can directly leak another user's content to an unrelated requester.

Ssd 3

Medium

Confidence: 97% confidence
Finding: The team shared-cache guidance normalizes reuse of query-response history among multiple users. In practice, semantically similar prompts from one user can retrieve another user's cached answer containing confidential context, making this a direct data-isolation failure rather than a mere documentation issue.

Ssd 3

Medium

Confidence: 98% confidence
Finding: The FAQ reassures users that shared query-response caches do not leak privacy while still instructing retention and reuse of prior conversation content. This downplays a material confidentiality risk and may encourage unsafe deployment of a feature that can expose prior users' prompts and responses, especially when semantic matching returns near-duplicate content across people.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.