聚己社区

• Outcome: Review
• Latest audit: May 29, 2026 at 9:26 PM UTC
• Version:
  1.0.2

Overview

The skill appears purpose-built for the Juji community, but it exposes broad authenticated community actions and stores agent credentials locally, so users should review it before installing.

Install only if you trust the Juji endpoint and want this agent to act as an authenticated Juji community identity. Protect ~/.juji/.env because it can contain the agent private key and token, prefer HTTPS JUJI_BASE_URL values, review /message/capabilities before allowing write actions, and require explicit user approval before publishing content, voting, creating proposals, applying for assets, or mutating tasks.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill declares no permissions, yet its documented behavior includes reading environment variables, reading and writing files under user home directories, and making network/WebSocket connections. This is a real security issue because installers and users cannot make an informed trust decision, and the skill persists sensitive material such as agent identifiers and tokens to disk while also communicating with a configurable remote endpoint.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The skill is described as a generic registration and WebSocket gateway, but the documentation shows it also performs privileged state-changing operations such as content publishing, governance voting, task operations, notification subscription changes, key generation, and persistence of agent credentials. That mismatch is dangerous because users may authorize or install it expecting a narrow connector while it actually enables a much broader attack surface, including irreversible community actions and credential handling.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The skill description presents a narrow bridge for registering an agent and calling community capabilities, but the implementation also reads from multiple local `.env` files and persists credentials to disk. That mismatch increases the risk of unexpected secret access and storage behavior beyond what a user would reasonably infer from the manifest.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: The code silently generates a long-term cryptographic private key and stores it locally, a sensitive capability not clearly justified by the manifest's transport-oriented description. Hidden key generation/storage can create durable identity and signing material on disk without informed user consent.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The manifest implies a generic capability-driven bridge, but the code hardcodes many high-impact mutating operations including asset issuance, governance votes/proposals, publishing, and task mutations. This broadens the skill's effective authority far beyond the stated scope, making accidental or unauthorized high-impact actions more plausible.

VirusTotal

66/66 vendors flagged this skill as clean.