Security audit

写作助手基础版

Security checks across malware telemetry and agentic risk

Overview

The skill is a plausible writing assistant, but it needs review because it claims local-only privacy while also describing external API, network, callback, and shell-capable behavior.

Review before installing. This does not show clear malicious behavior, but avoid using it with confidential drafts, private documents, secrets, or proprietary material unless you are comfortable with possible external API processing, callback delivery, local file reads, and shell command use. Confirm exactly when network calls, callbacks, caching, and exec commands are allowed.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The skill states that all data is stored locally and not uploaded, but elsewhere it declares reliance on external APIs and network connectivity. This creates a misleading privacy boundary: users may provide sensitive content believing it never leaves the machine, when the agent may transmit prompts, documents, or metadata to external services.

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: This is a stronger form of the same issue: the documentation explicitly promises no cloud upload while later requiring external APIs/network access. Such contradiction can cause users to expose confidential drafts, proprietary documents, or API-linked workflow data under false assumptions, making it a serious trust and privacy failure.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The invocation language is broad enough to match ordinary writing requests, which increases the chance the skill activates in situations users did not specifically intend. In a skill with read/exec/grep/glob capabilities, over-broad triggering raises the risk of unnecessary file access, command execution, or unintended data handling during routine conversations.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill advertises exec capability but does not clearly warn that shell commands may be run or explain associated risks. Because users may supply natural-language inputs that get translated into actions, this omission can lead to unexpected command execution, environment inspection, or file-system side effects without informed consent.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill supports external API use and a callback_url parameter but does not clearly disclose that user content or results may be transmitted off-host. Callback URLs especially introduce a data egress path that can send generated content, metadata, or logs to arbitrary endpoints if misconfigured or abused.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.