PIPL-Compliance（PIPL合规工具）

• Outcome: Pass
• Latest audit: Jul 25, 2026 · 1:03 AM UTC
• Version: 1.2.3

Overview

This appears to be a local PIPL compliance/reporting helper with no hidden network or persistence behavior, but its legal coverage and dependency-locking claims should not be relied on blindly.

Install only if you are comfortable with a local CLI tool that reads user-provided compliance data and writes reports/documents to paths you choose. Treat generated legal documents and audit results as drafts, verify the PIPL checklist coverage independently, and consult qualified counsel before using outputs for compliance decisions.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence
• Finding: The skill's documented behavior does not fully match its actual capabilities and examples, which weakens trust boundaries and can cause users or agent frameworks to authorize the skill under incomplete assumptions. In security-sensitive agent ecosystems, inaccurate claims about optional dependencies, audit coverage, and scope can lead to overtrust, unsafe invocation, or missed compliance gaps.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: Stray Python cleanup code embedded inside a Markdown skill document is dangerous because downstream tooling may extract or execute code blocks or mixed content incorrectly, creating ambiguity about what is documentation versus executable logic. In an agent setting, hidden or malformed code in the manifest increases the risk of unintended execution paths and undermines auditability claims.

Intent-Code Divergence

Medium

• Confidence: 82% confidence
• Finding: The document states scripts do not read outside the project directory, yet usage examples indicate arbitrary user-specified file inputs. This mismatch can mislead users and policy enforcement systems about the skill's data access boundary, potentially exposing sensitive local files if invoked with untrusted paths.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The template is presented as a PIPL-focused compliance artifact, but these clauses describe broad, generic data collection categories that may cause users to generate privacy notices exceeding their actual processing activities or the tool’s stated China-focused compliance scope. In a compliance tool, inaccurate default legal text is dangerous because organizations may publish it verbatim, creating regulatory misrepresentation and masking real data practices that require tailored disclosure under PIPL.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: These default marketing, personalized advertising, and analytics purposes are overbroad for a PIPL compliance generator and may lead users to claim invasive processing activities they have not separately assessed or validly authorized. Under PIPL, such purposes can trigger heightened consent, transparency, and opt-out obligations, so shipping them as default language materially increases compliance and privacy risk.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The code and surrounding metadata/documentation disagree on the scope of the `small_processor_audit` scenario: the skill metadata claims a 24-item audit framework, while the implementation registers only 19 checks. In a compliance tool, this can produce a false sense of legal completeness, causing users to rely on an incomplete audit and miss required obligations, especially for regulated PIPL assessments.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# 所有依赖版本锁定以确保运行稳定和通过安全扫描

pandas==2.2.0
jinja2>=3.1.6

• Confidence: 92% confidence
• Finding: The dependency specifier `jinja2>=3.1.6` is not actually version-pinned despite the comment claiming all dependencies are locked. This can lead to non-reproducible builds and unintended upgrades to future versions, increasing supply-chain risk if a later release introduces a vulnerability, breaking change, or malicious compromise.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.