Virsical 办公助手

• Outcome: Review
• Latest audit: Aug 4, 2026 · 10:10 AM UTC
• Version: 1.0.3

Overview

The skill matches its stated Virsical workplace-assistant purpose, but it handles account tokens and can create live bookings or work orders with insufficient confirmation safeguards.

Review before installing if this will run in a shared or logged environment. Use it only in a trusted private session, avoid pasting authorization codes where transcripts may be retained, and require the agent to confirm exact booking or work-order details before submission. Treat the local skill directory as sensitive because it may contain refresh tokens after login.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the user to paste an Agent authorization code directly into the chat, even though it acknowledges the code is a sensitive credential. Chat channels are often logged, retained, or exposed to the model/runtime, so collecting reusable credentials in-band can lead to account takeover or unauthorized API access if logs, transcripts, or downstream tooling are compromised.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: Booking a meeting room is a user-affecting write operation that can reserve shared resources, create conflicts, and trigger downstream notifications. Although the workflow gathers preferences earlier, the skill does not require a final explicit confirmation immediately before submitting the reservation, increasing the risk of accidental or manipulated bookings.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The work-order flow explicitly allows inferred execution without confirming with the user before creating a ticket. This can create false maintenance requests, consume operational resources, and submit inaccurate incident details, especially if user input is ambiguous or adversarially crafted.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documented agent login flow tells users to paste an authorization code into chat, but does not clearly warn that the code is a sensitive credential that should only be shared with the trusted skill/session. In a chat-integrated workflow, users can easily disclose the code in the wrong channel, to another bot, or in a retained conversation log, enabling token issuance and account access if intercepted before expiry.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This command reference includes authentication and session-management commands that can log in, exchange authorization codes for tokens, and log out against a real external platform, but it does not clearly warn that these actions affect live account state and may contact production services. In an agent-execution context, this increases the risk of unintended external actions, credential handling mistakes, or account/session disruption if commands are copied and run without explicit user confirmation.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The file provides direct commands to book meeting rooms and create work orders in an external system, but it does not clearly disclose that these commands create real records and can trigger operational consequences for users and facilities teams. In this skill's context, that is more dangerous because the skill is explicitly designed to manage meetings, visitors, and facilities, so accidental execution could create bookings, tickets, notifications, or resource conflicts in production.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The code persists access and refresh tokens to a local JSON file under the skill directory, which creates a credential exposure risk if the host is multi-user, backups are accessible, or the working directory is readable by other processes. Although it attempts to chmod the token file to 0600, that protection is best-effort only, does not cover all platforms, and there is no encryption or secure OS-backed credential storage.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.