Security audit

Office Collaboration Radar (Chinese)

Security checks across malware telemetry and agentic risk

Overview

This skill coherently analyzes user-provided workplace collaboration text locally, with no evidence of hidden network access, credential use, or external system mutation.

Before installing, be aware that this skill is intended for potentially sensitive workplace chat and meeting text. Use explicit prompts if you do not want implicit invocation, pass --out to avoid replacing a draft card, and provide an entities list when personal names should be redacted more aggressively.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The example output claims automatic PII desensitization, but it still includes identifiable personal names and role associations such as '张三', '李四', and '王经理'. In a collaboration-analysis skill, example outputs strongly shape real implementations and operator expectations, so this mismatch can normalize leaking employee identity and responsibility data into downstream systems or shared reports.

Intent-Code Divergence

Low

Confidence: 91% confidence
Finding: The template makes a strong security guarantee that all user-derived Markdown cell content and resulting JSON are sanitized, but this file itself contains only declarative text and no enforcement or validation. That can create a false sense of safety for downstream consumers, causing untrusted collaboration content to be rendered or exported without the claimed escaping if the referenced processing step is absent, bypassed, or incomplete.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The default prompt uses very broad trigger phrases such as group chat records, meeting notes, project progress, to-do extraction, risks, owners, and dependencies, combined with implicit invocation. This can cause the skill to activate on ordinary workplace conversation without clear user intent, increasing the chance that sensitive collaboration content is routed into this skill unexpectedly.

Natural-Language Policy Violations

Medium

Confidence: 83% confidence
Finding: The metadata and prompt are written to present and invoke the skill in Chinese by default, without any indication that the user's language preference is checked first. While not directly a code-execution issue, forced language behavior can mislead users, reduce comprehension of how sensitive collaboration data is being processed, and increase the chance of mistaken consent or unnoticed autonomous invocation.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The enforce CLI defaults to writing the processed output back to the same path supplied via --card when --out is omitted, which can silently overwrite the user's original extracted card. This is a real safety issue because it destroys the source artifact and can cause accidental data loss or corruption of intermediate workflow state, especially in automation where users may not notice the default behavior.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The schema explicitly mandates Chinese output for all JSON-facing content without indicating that this is conditional on user locale or workspace language. In a collaboration-analysis skill, forcing a fixed language can mis-handle user intent, reduce accessibility for non-Chinese users, and create downstream integration errors where consuming systems or reviewers expect locale-preserving output.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.