Security audit

intelligence-radar

Security checks across malware telemetry and agentic risk

Overview

The skill has a coherent sales-intelligence purpose, but it asks users for passwords in chat, sends credentials and raw user input to an HTTP backend, caches shared tokens locally, and can modify customer records.

Review before installing. Use this only if you trust the backend operator and are comfortable with employee credentials, bearer tokens, company queries, and full prompts being sent to the configured HTTP service. Prefer a secure authentication flow outside chat, HTTPS-only endpoints, per-skill scoped token storage, narrow triggers, and explicit confirmation before any customer record is created.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (16)

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The skill’s stated scope says it checks or associates customers, but the documented flow also lets a follow-up message of “添加” trigger a stateful POST that creates a customer record. That hidden capability expands the skill from read-mostly intelligence retrieval to a write action against backend business data, increasing the chance of unintended or unauthorized data modification.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The description omits that the skill prompts for employee credentials, may force a password change, and stores tokens locally for reuse. Hiding authentication collection and credential-handling behavior prevents informed consent and makes accidental disclosure or unsafe operation more likely in a conversational environment.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The template instructs the agent to run shell-style installation commands (`byted-skillhub-download`, `openclaw skills install`) as part of a user-facing workflow, even though the skill’s business purpose is intelligence collection and analysis. Embedding operational command execution into prompt templates expands the agent’s authority and creates command-execution and supply-chain risk if the install source, package resolution, or invocation context is manipulated.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The template tells the agent to use an account and password, call a login API, and cache a token, which materially exceeds simple intelligence summarization and introduces credential-handling behavior. This is dangerous because prompts are not a safe place to orchestrate secret collection/storage, and compromised prompt flows can leak credentials, misuse tokens, or normalize phishing-like interactions.

Vague Triggers

High

Confidence: 89% confidence
Finding: The trigger list includes broad phrases like ‘最近动态’, ‘帮我准备’, and ‘帮我分析’, which are common in ordinary conversation and can invoke the skill unintentionally. Because this skill sends raw user input to a backend and may prompt for credentials or modify customer data, accidental activation has meaningful privacy and integrity consequences.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The workflow explicitly forwards the user’s original input and company query to backend services, but the skill does not provide a clear upfront warning or consent step. Users may include sensitive sales notes, customer plans, or credentials in natural language, and those would be transmitted externally without adequate notice.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The template says the skill will collect public intelligence and check whether the company exists in a customer database, including one-click record creation, without any user-facing disclosure of data handling or system modifications. That creates consent and transparency issues because the user may not realize the agent is querying internal systems or preparing to change CRM state, which can lead to unintended data processing or record pollution.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The prompt explicitly asks for login account and password, then directs the agent to call a login API and cache a token, all without warning the user how credentials will be handled. This is a serious unsafe-prompt pattern because it encourages direct secret capture by the conversational layer and silent persistence of authentication artifacts.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The trigger phrases include broad, natural-language intents such as '我想了解', '帮我准备', and '帮我分析', which can match many unrelated user requests and cause unintended invocation of this skill. In this skill’s context, unintended activation may launch backend intelligence collection workflows and customer-related checks without the user clearly intending to do so, increasing privacy, operational, and consent risks.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The skill instructs users to enter an account and password directly in chat and describes token caching, but provides no warning about credential sensitivity, masking, secure entry, storage protections, or limits on reuse. This creates a real risk of credential exposure in chat logs, transcripts, analytics systems, or to unintended operators/services, especially because the workflow explicitly solicits secrets from the user.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill automatically checks whether a company exists as a customer and supports a quick-add flow, but the description does not clearly warn that this can affect customer records or explain validation/authorization safeguards. In this business context, accidental or unauthorized record creation can corrupt CRM data, expose internal customer-status information, or trigger downstream sales workflows based on an unintended action.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The trigger list includes very generic business phrases such as '最近动态', '最新动态', '我要拜访', and '帮我准备', which are likely to appear in ordinary conversation and can cause unintended activation. In this skill, unintended invocation is more concerning because activation can initiate backend intelligence collection and customer-association workflows, potentially causing unnecessary data processing or actions without clear user intent.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The skill documentation declares '{employee_id}' and '{password}' as dynamic variables, normalizing credential use inside the skill interface without any warning, scoping, or secure handling guidance. Even though the file is only documentation, this creates a real risk that passwords will be collected, interpolated, logged, or passed to backend systems unnecessarily, exposing sensitive credentials to the agent stack.

Ssd 3

High

Confidence: 98% confidence
Finding: The skill instructs the agent to parse account IDs and passwords from free-form chat input and then persist resulting authentication material for reuse. Collecting secrets in natural-language conversation dramatically raises the risk of exposure through logs, prompt history, transcript retention, cross-skill access, or accidental disclosure.

Ssd 3

High

Confidence: 97% confidence
Finding: The skill explicitly directs reuse and sharing of cached authentication tokens across multiple skills. Cross-skill credential reuse breaks least privilege and increases blast radius: compromise, misuse, or accidental invocation in any one skill can expose access intended for another workflow.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The template instructs the agent to echo the login account back to the user after credential-based authentication. Even though the password is not reflected, redisplaying account identifiers after auth can expose sensitive internal usernames on shared screens, in chat logs, or to shoulder-surfing observers, increasing privacy and account-enumeration risk.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.generated_source_template_injection

User-controlled placeholder is embedded directly into generated source code.

Critical

Code: suspicious.generated_source_template_injection
Location: SKILL.md:423