Security audit

别瞎说 - AI事实核查器/Checktruth - AI Fact-Checker

Security checks across malware telemetry and agentic risk

Overview

This fact-checking skill is coherent and disclosed; its risk is mainly in optional developer scripts that send text to external AI providers when manually run.

Normal installation is reasonable for fact-checking, but expect web searches to be used. Do not run the optional reference Python scripts on sensitive text unless you are comfortable sending that text to the configured AI providers, and review or pin the optional Python dependencies first.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Tainted flow: 'headers' from os.getenv (line 34, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Content: "temperature": 0.1, "max_tokens": 2000 } resp = requests.post( f"{api_base}/chat/completions", headers=headers, json=payload,
Confidence: 72% confidence
Finding: resp = requests.post( f"{api_base}/chat/completions", headers=headers, json=payload, timeout=60 )

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The module reads an API credential and transmits answer content to an external LLM service, but the file provides no clear consent, policy boundary, or data-classification guardrails. If answers contain sensitive user, internal, or regulated data, this creates a real confidentiality risk through third-party disclosure.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The requirements explicitly say the skill will send user questions to multiple AI APIs, but the document contains no requirement to notify users or obtain consent before transmitting their prompts externally. This creates a real privacy and data-handling risk because users may submit sensitive, proprietary, or regulated information under the assumption verification happens locally or within the primary platform.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill accepts an optional reference as a string or URL, and the verification design relies on external AI services, yet there is no warning that reference content or fetched source material may also be transmitted to third parties. That omission is dangerous because references may contain private documents, internal URLs, credentials in query strings, or other sensitive material that would be unnecessarily exposed.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The design explicitly proposes sending the user's question and answer to multiple third-party AI providers, but the document does not mention consent, disclosure, minimization, or handling of sensitive data. This creates a real privacy and data-governance risk because users may submit confidential, personal, or regulated information that would be replicated across several external services without clear warning or control.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The script sends user-supplied question/answer or text content to third-party LLM providers without an explicit privacy notice, consent step, or data-handling disclosure. If users submit sensitive, proprietary, or regulated data, it may be transmitted outside the local environment and retained or processed by external vendors unexpectedly.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: Additional provider integrations transmit user content to remote APIs, expanding the data-sharing surface across multiple vendors. In a verification tool, users may reasonably assume analysis is local unless warned otherwise, so silent transmission increases confidentiality and compliance risk.

Missing User Warnings

Low

Confidence: 88% confidence
Finding: The script persists both input content and model outputs to verification_result.json without prior warning or an opt-in mechanism. If the verified material contains sensitive business, personal, or regulated information, local persistence can create unintended data exposure on shared systems, backups, or developer workstations.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The code sends the full answer text to an external API without any user-facing warning or minimization. Because answers may contain secrets, personal data, or proprietary text, forwarding the entire content can expose sensitive material beyond the local trust boundary.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The function sends user-supplied answer content to an external LLM service without any notice, consent flow, or data-classification guardrails. If the input contains secrets, personal data, or proprietary content, this causes unintended third-party disclosure during normal operation.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: This module forwards raw question content to multiple third-party AI providers without any explicit warning, consent check, or sensitivity filtering. In a skill that aggregates answers across vendors, this materially increases privacy and data-governance risk because one user input may be replicated to several external services.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: This module sends the provided facts and references verbatim to an external LLM service for verification, but the code offers no consent, warning, or data-classification check before transmission. If facts or references contain sensitive, proprietary, or personal data, the skill can exfiltrate that content to a third-party processor unexpectedly.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.