Security audit

Chief

Security checks across malware telemetry and agentic risk

Overview

The skill is a coherent HR diagnosis assistant, but it automatically stores sensitive HR case data and evaluator failure records without clear user opt-in or retention controls.

Review this skill before installing if your HR data contains employee names, compensation, disputes, performance details, or confidential business context. Use it only with a dedicated KB path, redact sensitive identifiers, and disable or manually control case-memory and failure-taxonomy writeback unless your organization has approved retention rules.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill documentation describes file read/write capabilities and local knowledge-base initialization, but no explicit permissions are declared. That creates a capability/permission gap where reviewers and users may not realize the skill can access or modify local files, weakening trust boundaries and increasing the chance of unintended data exposure or persistence.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The stated purpose is HR diagnosis, but the skill also initializes filesystem content, recursively reads local knowledge bases, validates citations against local files, and emits verification artifacts. This mismatch is dangerous because it hides a much broader operational surface than users would expect, enabling collection, persistence, and processing of local organizational data under the guise of analysis.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: Persistent case-memory and failure-taxonomy writeback store analysis artifacts beyond the immediate session, which is not necessary for basic HR diagnosis. In an HR context, those artifacts can contain sensitive organizational, personnel, or dispute-related information, creating retention and privacy risks if stored without strong minimization and consent controls.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The spec instructs the evaluator to append failure records to `FAILURE_TAXONOMY.md`, creating a persistent side effect outside the skill’s stated analytical/diagnostic purpose. Even if intended for quality tracking, this expands the skill from analysis into repository modification, which can corrupt shared state, create unauthorized audit trails, or be abused to smuggle content into project files.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: Automatically writing to a shared taxonomy file gives an HR diagnostic skill an unjustified mutation capability that is not necessary to answer user requests. Shared-file writes can be exploited to poison future workflows, introduce misleading records, or create covert persistence across runs and users.

Description-Behavior Mismatch

Medium

Confidence: 87% confidence
Finding: The document explicitly routes '工具/模板任务' to direct execution and even shows a non-diagnostic example (JD generation), which conflicts with the skill metadata stating the skill is not applicable to routine HR tasks such as template generation. This can cause policy/intent drift: users may invoke the skill for out-of-scope tasks and receive outputs without the deeper validation path, increasing the chance of misuse, incorrect handling, or bypass of intended safeguards.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The specification places a raw reasoning field (`<tot_paths_raw>`) directly inside the main diagnosis XML while simultaneously claiming it is 'stored only, not passed on'. That contradiction creates a strong risk that chain-of-thought or other sensitive intermediate reasoning will be propagated to downstream components, logs, or users, causing prompt leakage and possible disclosure of sensitive HR analysis data.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The document says `<scratchpad>` must not be output to users, yet it is defined as a normal field in the complete XML template and even required before later steps. This mismatch makes accidental disclosure likely, exposing internal reasoning, deliberation traces, and possibly sensitive employee or organizational judgments in an HR diagnostic context.

Missing User Warnings

Low

Confidence: 88% confidence
Finding: The markdown describes modifying a repository file without any warning, consent boundary, or indication that the action changes persistent project state. Lack of disclosure increases the chance of unintended writes and makes it harder for operators to distinguish pure analysis from side-effecting behavior.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The skill content is written entirely in Chinese and strongly implies Chinese-language operation without offering any mechanism to preserve or negotiate the user's preferred language. This can override user expectations, reduce accessibility, and cause incorrect or noncompliant outputs in multilingual environments, especially if the surrounding system assumes language neutrality.

Ssd 3

Medium

Confidence: 94% confidence
Finding: The skill instructs the agent to persist user-provided organizational case data after analysis. In an HR setting, that data is likely to include sensitive personnel, performance, culture, or dispute information, so silent persistence materially increases confidentiality, retention, and secondary-use risk.

Ssd 3

Medium

Confidence: 90% confidence
Finding: Mandating ongoing accumulation of historical case memory creates a standing repository of sensitive organizational knowledge. Even if intended for quality improvement, this broad retention expands the blast radius of any misconfiguration, unauthorized access, or later misuse.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.