Security audit

Weiyun Toolkit Free

Security checks across malware telemetry and agentic risk

Overview

The skill mostly describes Weiyun cloud file transfers, but its routing text and endpoint/script guidance are too broad for a tool that can read local files, use tokens, and upload or download data.

Install only if you intend to use it specifically for Weiyun file browsing, downloads, and uploads. Confirm exact local file paths before upload, keep WEIYUN_MCP_TOKEN protected, avoid arbitrary MCP server URLs unless independently verified, and do not let the skill activate for unrelated analytics or reporting tasks.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 87% confidence
Finding: The skill’s stated free-edition scope is limited to browsing, downloading, and uploading Weiyun files, but it additionally instructs the agent to run unrelated diagnostic commands such as network testing. That scope expansion is dangerous because it normalizes arbitrary local command execution under a file-management skill, increasing the chance an agent performs actions the user did not intend.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The manifest says the skill should be used for data analysis, reporting, statistics, and visualization, but the actual content is a cloud file-management toolkit. This mismatch is risky because it can cause over-broad or mistaken activation, leading agents to invoke a file-access skill in unrelated contexts where local files, tokens, or remote transfers may be exposed unnecessarily.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The skill encourages shell-based network diagnostics like ping/firewall/proxy checks even though its purpose is Weiyun file management. This is dangerous because it broadens agent behavior from service interaction into host-level command execution, which can be abused for environmental probing or unintended local actions.

Intent-Code Divergence

Medium

Confidence: 81% confidence
Finding: The documentation advertises a user-supplied `--mcp_url` while separately claiming only Weiyun/QQ endpoints are accepted, but no enforcement is shown in the skill content. If the script or agent honors arbitrary MCP URLs, tokens and file metadata could be sent to attacker-controlled endpoints under the guise of normal uploads.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The skill description defines an overly broad and conflicting activation scope, combining Weiyun file management with unrelated analytics and visualization scenarios. In agent environments, ambiguous routing is a security issue because it increases accidental invocation of a tool with read/write/exec capabilities outside its legitimate context.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The capability coverage keyword list is excessively broad, fragmented, and ambiguous, making it easier for the skill to match prompts outside its intended purpose. Because the skill exposes file operations and exec capability, over-triggering increases the risk of unnecessary access to local files, tokens, or shell execution paths.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.secret_argv_exposure

Instructions pass high-value credentials through process argv.

Critical

Code: suspicious.secret_argv_exposure
Location: SKILL.md:97