Security audit

每日毛选语录硬核推送

Security checks across malware telemetry and agentic risk

Overview

This skill matches its stated purpose: it generates a daily Mao quote note, writes it locally, and can send it through user-configured messaging services.

Before installing, use dedicated DeepSeek and Telegram credentials, run `python3 scripts/generate_daily.py --test` or `--no-send` first, and confirm the output directory points to the intended Obsidian vault. Only create the cron job if you want daily automatic file creation and Telegram sending, and treat README image/voice claims as stale unless separately verified.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill declares access to environment variables in `requires`, but the metadata does not explicitly declare the broader sensitive capabilities it uses, including file writes, network access, and shell/cron-style automation. This weakens transparency and consent: users may install a seemingly simple content skill without realizing it can write to local paths and transmit content externally, increasing the risk of unintended data exposure or abuse if the implementation changes.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 89% confidence
Finding: A description-behavior mismatch is a real security issue because users rely on the manifest to understand what the skill will do. If the skill supports additional channels like Feishu, lacks the promised media generation, or references inconsistent APIs/configuration, users can misconfigure it, send data to unexpected services, or grant trust under false assumptions.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The README explicitly advertises automatic generation and pushing of content to both an Obsidian vault and Telegram, but it does not warn users that this creates local files and sends data to an external messaging platform. In an agent-skill context, unattended file writes and outbound network actions can surprise users, expose generated or sensitive content, and create privacy or operational risks if enabled without clear consent boundaries.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The README documents daily scheduled execution via cron without clearly warning that it will run unattended and automatically perform recurring file creation and network pushes. In automation ecosystems, silent recurring execution increases the risk of unexpected data egress, spammy outbound messages, quota/cost consumption, and persistence of behavior after the user forgets it was enabled.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The skill automatically pushes generated content to Telegram and writes files locally, but it does not clearly warn users that content will leave the local environment and be handled by a third-party messaging platform. If users include sensitive notes, prompts, or metadata in generated content, this can cause unintended privacy leakage through scheduled external transmission.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill requires sensitive secrets such as `DEEPSEEK_API_KEY` and `TELEGRAM_BOT_TOKEN` but does not provide strong guidance on secure storage, rotation, or avoiding accidental disclosure in shells, logs, and shared config. Poor secret-handling instructions often lead to token leakage, which can enable unauthorized API use, spam, message interception, or account abuse.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The script automatically sends generated content to Telegram using environment-provided bot credentials, but there is no explicit user-facing consent or warning at the point of transmission. In an agent-skill context, this can cause unintended disclosure of generated content or embedded sensitive data to an external service, especially since sending is enabled by default unless '--no-send' is provided.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.