ClawHub
Back to skill

Security audit

Virscial Skill

Security checks across malware telemetry and agentic risk

Overview

The skill appears to be a real Virsical workplace assistant, but it handles account authorization, stores reusable tokens locally, exposes visitor contact data, and can create live bookings or tickets with safeguards that are under-disclosed.

Review before installing. Use this only in a private trusted chat, treat Agent authorization codes and the local token file as secrets, confirm every booking or work-order creation before execution, verify the Virsical base URL is your real tenant, and expect visitor queries to reveal phone numbers.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (10)

Lp3

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding
The skill instructs the agent to execute Python and shell commands, perform network requests, and read/write local files (including token storage), but the manifest shown in this file does not declare corresponding permissions. This creates a transparency and policy-enforcement gap: users and the platform may not understand the skill's actual authority, increasing the risk of unintended command execution, local data exposure, and network misuse.

Vague Triggers

Medium
Confidence
78% confidence
Finding
The trigger list contains broad English phrases like "work order" and "facility management," which are likely to appear in ordinary conversation and can cause accidental invocation of a skill that performs authenticated enterprise actions. In this context, unintended activation is more concerning because the skill can guide credential submission and execute real business operations such as booking rooms and creating tickets.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill explicitly asks users to paste an Agent authorization code into the chat and stores local tokens, but it does not warn that these are sensitive credentials that should be handled carefully. Without an explicit warning, users may disclose reusable secrets in an unsafe channel or misunderstand retention risks, enabling account takeover or unauthorized API use if the conversation or local storage is exposed.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The document instructs users to copy an Agent authorization code from the Virsical UI and paste it into the chat, but it does not warn that this code is a credential equivalent for token issuance and must not be shared in insecure channels or exposed to other participants, logs, or support transcripts. In a chat-based skill context, prompting users to paste secrets directly into conversation increases the chance of credential leakage through message history, platform retention, or accidental disclosure.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The document specifies local JSON storage for access and refresh tokens and even shows the structure, but does not clearly warn about the sensitivity of those tokens or the risks of compromise from local file access, backups, sync tools, or multi-user hosts. Although the document later mentions setting permissions to 0600, the storage design still exposes long-lived credentials locally and lacks stronger guidance such as secure OS keychain storage, encryption at rest, and avoiding plaintext token persistence where feasible.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
This command reference includes a real meeting-room booking operation that changes external system state, but the surrounding documentation does not clearly warn that executing it will create an actual reservation. In an agent skill context, executable snippets are especially risky because an agent or operator may treat them as harmless examples and trigger unintended bookings, calendar conflicts, or misuse of organizational resources.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The work-order creation command submits a real ticket but is documented like a normal copy-paste snippet without an explicit warning that it creates a live record. In a support or workplace automation setting, this can lead to unauthorized or accidental ticket creation, operational noise, reputational impact, and abuse of downstream maintenance workflows.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The module returns and formats visitors' phone numbers by default, exposing personally identifiable information without any access-control check, masking, or user-consent/disclosure mechanism in this code path. In a visitor-management skill, this increases privacy risk because conversational interfaces can easily surface sensitive data to unintended viewers or logs.

Credential Access

High
Category
Privilege Escalation
Content
access = token.get("access", "")
        if not access:
            return {"valid": False, "message": "No access token", "username": ""}

        try:
            credentials = "bG9naW4tYWdlbnQ6QWdlbnQjMjAyNg=="
Confidence
89% confidence
Finding
access token

Credential Access

High
Category
Privilege Escalation
Content
_env = _load_env()

# 优先从 virsical.env 读取，不存在则使用默认值
DEFAULT_BASE_URL = _env.get(
    "VIRSICAL_BASE_URL", "https://cloud.virsical.cn"
)
Confidence
69% confidence
Finding
.env

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.