Security audit

有道云工作总结规划

Security checks across malware telemetry and agentic risk

Overview

The skill’s core purpose is coherent, but it asks for a personal cloud-note key, reads private work notes, and saves derived findings locally without enough consent and retention controls.

Install only if you are comfortable granting access to the specified Youdao Cloud Note folders and having summaries of the analysis saved locally. Use the narrowest folder, title keywords, and time range possible, avoid pasting long-lived secrets into ordinary chat or reports, and delete `.workbuddy/memory/` entries after use if you do not want the findings retained.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The skill explicitly instructs the agent to persist derived analysis data into `.workbuddy/memory/`, which goes beyond the immediate purpose of generating the requested reports. Because the source data comes from personal work notes, the stored summaries and findings may contain sensitive business, personnel, or operational information that can later be exposed or reused without the user's clear expectation.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The template imports Chart.js from a third-party CDN at render time, which introduces external code execution and a network dependency into what should otherwise be a local reporting artifact. If the CDN response is tampered with, unavailable, or replaced by a malicious payload, opening the generated report could execute attacker-controlled JavaScript in the viewer's browser.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger list contains broad phrases like work analysis, work summary analysis, and time management planning that are common in normal conversation. This increases the chance of unintended activation, causing the skill to solicit credentials or begin sensitive notebook-access workflows when the user did not intend to invoke this specific capability.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The skill requires the user to provide a personal Youdao cloud note key for MCP authentication but does not warn that this is a sensitive credential or instruct the user on safe handling. In practice, this can normalize unsafe credential sharing and lead users to expose long-lived access tokens that grant broad access to their notebook data.

Missing User Warnings

High

Confidence: 96% confidence
Finding: The skill instructs the agent to search and read notebook contents but does not clearly warn the user that potentially sensitive note text will be accessed and processed. Since work notebooks often contain confidential business information, personal data, or internal plans, the lack of disclosure undermines informed consent and increases the risk of over-collection.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill tells the agent to store derived analysis data in local memory without notifying the user that results will persist beyond the session. Even if only summaries are stored, they may still reveal sensitive work patterns, priorities, or project details and can be surfaced later in unrelated contexts.

Ssd 3

Medium

Confidence: 94% confidence
Finding: Retaining user-derived analysis data in local memory creates a data retention and unintended disclosure risk because the saved material originates from private work logs. Natural-language summaries can still contain confidential operational details, making later leakage, accidental reuse, or cross-task exposure plausible.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.