Security audit

smartbi-cli

Security checks across malware telemetry and agentic risk

Overview

This skill is not deceptive, but it gives an agent broad Smartbi API authority, local token persistence, scheduled automation, and outbound messaging with incomplete safety guardrails.

Install only if you trust the Smartbi environment and the @smartbi/cli package, and use a least-privileged, revocable token. Before allowing actions, review every operationKey, request body, schedule, recipient, webhook URL, and outbound message content. Avoid using broad admin tokens, restrict ~/.smartbi/config.yaml permissions, rotate tokens if exposed, and do not let the agent fetch arbitrary external documentation links or activate recurring jobs without explicit approval.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The skill explicitly allows recursive documentation traversal to fetch external URLs via WebFetch. Because all skill content must be treated as adversarial, this creates an unnecessary outbound network capability that can exfiltrate prompt/context data, follow attacker-controlled links, or expand the trust boundary beyond the Smartbi CLI/docs domain. In this BI CLI context, external web retrieval is not required for normal API discovery and contract understanding, so the feature increases risk without clear necessity.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The README promotes creating and enabling scheduled tasks that can send email or other messages automatically, but it does not instruct the agent or user to require explicit confirmation before activation. In this skill context, scheduled execution and outbound delivery are operationally impactful actions that could spam recipients, leak business data on a recurring basis, or trigger unintended automation if misinterpreted from natural language.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The installation guidance tells users to populate baseUrl and token in a local config file without any warning about secret handling, least privilege, or storage risks. Because this skill grants broad Smartbi API access, mishandled tokens could expose data sources, schedules, metadata, and administrative operations well beyond the immediate task.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The README says the agent can discover APIs, understand contracts, and execute Smartbi calls automatically, but it omits any warning that these calls may read sensitive data, modify models, manage resources, or transmit results externally. In this skill, the context increases severity because the advertised scope includes data querying, modeling, scheduling, messaging, and permission-related operations across the Smartbi platform.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The trigger conditions are broad enough to activate on many generic BI-related requests, even when the user did not clearly intend to use this skill. Over-broad activation can cause unintended tool use, unnecessary credential prompting, or execution of sensitive Smartbi operations in response to ambiguous natural-language queries. The risk is elevated here because the skill can perform data access, modeling, scheduling, messaging, and permission-related actions.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill instructs automatic creation of `~/.smartbi/config.yaml` containing `baseUrl` and a personal token, but does not require a clear user-facing disclosure that credentials will be stored locally. This can lead to users unknowingly persisting sensitive secrets on disk, increasing exposure through local compromise, backups, shared accounts, or accidental leakage. In this context the token likely grants access to BI data and administrative operations, making silent persistence materially risky.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The file instructs writing a long-lived access token into ~/.smartbi/config.yaml and explicitly enables plain-token storage in the example, but provides no warning about local secret exposure, file permissions, rotation, or safer storage alternatives. In a CLI skill that manages BI data sources, permissions, and messaging integrations, compromise of that token could grant broad access to sensitive business data and administrative operations.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The template explicitly retrieves authentication tokens and uses them to make outbound authenticated HTTP requests, but it does not require any user confirmation, destination allowlisting, or prominent disclosure that user-scoped credentials may be used to access and transmit data. In an agent skill that auto-fills placeholders from user prompts, this creates a real risk of silent data access and exfiltration to attacker-chosen endpoints if BASE_URL or related parameters are influenced by untrusted input.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: This scenario operationalizes sending agent-generated content to external channels but does not require any privacy, sensitivity, or authorization check before transmission. In an agent workflow, that omission can cause confidential business data, personal data, or internal reports to be exfiltrated to third-party systems or unintended recipients through routine use rather than an explicit attack.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The examples normalize use of webhook URLs, agent identifiers, recipient lists, and HTML/email delivery without any warning that webhook URLs and channel secrets are credentials and that messages may leave the trusted environment. If these values are exposed in prompts, logs, files, or reused carelessly, attackers can send unauthorized messages, harvest sensitive routing information, or cause data leakage to external platforms.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.