DinzeeAgent

• Outcome: Review
• Latest audit: Aug 10, 2026 · 9:45 AM UTC
• Version: 1.0.3

Overview

This skill has a coherent e-commerce data purpose, but it can install/update local skills, charge user points, and store business call records with overly broad local permissions.

Review this before installing in any shared, privileged, or production agent. Use it only if you trust Dinzee’s gateway-delivered skills, confirm point charges before install/update/call operations, avoid broad skill update requests, do not override the skills directory except to a controlled skills root, and prefer --no-save or a restricted private DINZEE_DATA_DIR for sensitive business data.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill directs the agent to use shell, network, file read/write, and environment-sourced credentials, but does not declare corresponding permissions. This creates a capability mismatch where operators or policy engines may underestimate what the skill can do, increasing the chance of unintended command execution, network access, or filesystem writes under user-triggered flows.

Context-Inappropriate Capability

High

• Confidence: 94% confidence
• Finding: The code allows the install target root to be overridden via --skills-dir or DINZEE_SKILLS_DIR and then resolves it directly. A caller who can influence these values can redirect installation into arbitrary filesystem locations, enabling overwrite of unrelated application content or staged code deployment when combined with package extraction.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: Before unpacking a gateway-delivered package, the installer unconditionally calls shutil.rmtree(target) if the target exists. If the target path is misdirected or attacker-controlled, this creates destructive deletion of local directories and reliable replacement of their contents with remote-delivered files.

Vague Triggers

Medium

• Confidence: 78% confidence
• Finding: The trigger guidance includes broad phrases such as generic install/update requests that can overlap with ordinary conversation, causing the skill to perform package sync or update actions without a narrowly scoped invocation. In a system that supports local shell execution and package delivery, ambiguous activation increases the risk of unexpected changes to the local runtime and supply-chain exposure.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The skill explicitly instructs the agent to map imprecise user intent to whichever local synchronized skill seems most relevant. Because those local skills may execute scripts and bill through the gateway, ambiguous semantic matching can trigger unintended workflows, data access, external calls, or package-specific side effects without the user naming the exact skill.

Missing User Warnings

Medium

• Confidence: 80% confidence
• Finding: The workflow spec explicitly says failed runs must return ledger details and partial artifacts, which can expose internal execution metadata, request/response summaries, artifact URLs, and operational context to end users. In this skill context, the agent brokers cross-border commerce workflows through a centralized gateway, so failure responses may reveal sensitive business data, internal tool behavior, or information useful for reconnaissance even if upstream credentials are not directly exposed.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The tool advertises access to a 'personal private keyword database' without any notice about consent, data scope, retention, or authorization checks. In a skill that routes calls through a gateway and discovers tools dynamically, this language suggests user-specific sensitive data access may be normalized without sufficient privacy safeguards, creating risk of unauthorized retrieval or misuse.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The description explicitly references retrieving data from a 'personal private keyword database,' which strongly implies handling user-specific sensitive or proprietary information. Without visible constraints on authentication, consent, or output filtering, this can expose private business intelligence or account-linked data through ordinary prompt usage.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

DEFAULT_CREDENTIALS_PATH = Path("/opt/data/.dinzee/credentials.json")
LEGACY_CREDENTIALS_PATH = Path.home() / ".dinzee" / "credentials.json"
DEFAULT_DATA_DIR = Path("/opt/data/.dinzee/data")
DATA_DIR_MODE = 0o777
DATA_FILE_MODE = 0o666

PROVIDERS_PATH = "v1/mcp/providers"

• Confidence: 99% confidence
• Finding: MODE = 0o777

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

LEGACY_CREDENTIALS_PATH = Path.home() / ".dinzee" / "credentials.json"
DEFAULT_DATA_DIR = Path("/opt/data/.dinzee/data")
DATA_DIR_MODE = 0o777
DATA_FILE_MODE = 0o666

PROVIDERS_PATH = "v1/mcp/providers"
TOOLS_PATH = "v1/mcp/tools"

• Confidence: 99% confidence
• Finding: MODE = 0o666

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.