Security audit

鲸采云SRM

Security checks across malware telemetry and agentic risk

Overview

This SRM procurement skill is coherent, but it needs Review because it asks for passwords in chat, stores a bearer token on disk, and can perform high-impact procurement changes through broad triggers.

Install only for a trusted Yidea SRM environment and avoid shared workspaces. Treat the chat password prompt and config/config.json token as sensitive, remove or rotate the token after use, and require explicit human confirmation before create, update, delete, order, receipt, payment, or approval actions.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill advertises and instructs use of network and environment-capable operations without declaring permissions, which undermines transparent consent and security review. In this context, the hidden capability is more concerning because the skill also handles authentication and remote business actions, so undeclared network/env access could expose secrets or enable unintended external calls.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The documented purpose presents a business procurement assistant, but the behavior includes direct credential login, local token/config storage, remote tool discovery, and generic remote invocation. This mismatch is dangerous because it conceals powerful execution and data-handling behaviors behind a benign business description, increasing the chance that users or reviewers authorize it without understanding the real risk surface.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The skill mandates collecting the user's username and password directly on every invocation, which trains users to disclose credentials in conversation and bypasses safer authentication patterns. In a procurement system, these credentials could grant access to supplier, contract, payment, and approval workflows, making account takeover and downstream business fraud plausible.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The documentation instructs the agent to execute local Node/PowerShell command-line operations as part of normal handling, which expands the attack surface from a simple business assistant to a local command runner. Even if intended for legitimate integration, command execution combined with remote inputs and file/stdin transport can lead to abuse, accidental command misuse, or unsafe handling of sensitive data.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The README explicitly instructs the skill to prompt for a username and password, perform authentication, and persist a token-bearing config file in the workspace, but it does not describe protections for secret storage, file permissions, token lifetime, masking, or user consent. In an agentic skill context, automatic credential capture and local persistence increase the risk of credential leakage, token theft, or accidental exposure through logs, backups, or shared workspaces.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The README advertises create, update, delete, submit, and procurement workflow actions across business-critical records without documenting confirmation gates, dry-run behavior, approval checks, or safeguards against accidental execution. In a procurement system, unintended destructive or state-changing actions can alter contracts, prices, orders, or supplier records, causing financial loss or workflow disruption.

Vague Triggers

High

Confidence: 91% confidence
Finding: The trigger phrases include broad everyday expressions such as buying or applying, which can cause the skill to activate in conversations that were not intended to perform procurement actions. Because this skill can lead into authentication, remote queries, and business transactions, unintended invocation materially raises the risk of accidental sensitive operations.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The keyword list contains generic terms like query, create, modify, delete, manage, and request, which are common in many unrelated conversations. In a skill that can authenticate and operate on procurement records, such broad scoping increases the chance of accidental routing into sensitive workflows or confusing this skill with other benign tasks.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The skill explicitly tells the agent to request a username and password directly, without a warning about credential sensitivity or a safer authentication channel. This is dangerous because it normalizes insecure credential handling and increases the likelihood of credential theft, logging exposure, replay, or misuse by the agent or connected systems.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The skill states that whenever the module is triggered or the user requests procurement business, the agent must first make an HTTP call to enumerate available forms. This creates an overly broad activation condition for an external action, so generic procurement-related requests can cause unintended system access or metadata disclosure before the user has clearly consented or selected a specific operation.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: Example triggers like '帮我买' and '替我买' are highly ambiguous and overlap with ordinary conversation, increasing the chance that the skill activates for unintended requests. In a system that performs business actions and form discovery, this can lead to accidental workflow initiation or exposure of procurement capabilities to users who did not explicitly request them.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The file mandates an HTTP direct call as the first step but does not warn the user that an external request will be made automatically. This reduces transparency and informed consent, and may expose internal form inventory or business metadata merely from invoking the skill rather than from a deliberate user-approved action.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The protocol requires the agent to automatically query related records immediately, without notifying the user or obtaining confirmation. In an SRM/procurement context, those related tables may contain supplier, pricing, contract, or internal procurement metadata, so automatic retrieval can expose sensitive business data beyond the user's intended action or awareness.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The script stores a bearer access token in a local JSON config file in plaintext, creating a persistent credential on disk without any access-control hardening or warning to the user. If the workstation, repository, backup system, or shared filesystem is exposed, the token can be reused to access the SRM/MCP backend and potentially perform procurement-related actions as the authenticated user.

Ssd 3

High

Confidence: 100% confidence
Finding: The skill requires the agent to always ask for the user's username and password before any action, creating a systematic phishing-like pattern. In the procurement context, compromise of these credentials could expose approval queues, supplier records, contracts, orders, and payment processes, enabling both confidentiality breaches and fraudulent transactions.

Ssd 3

Medium

Confidence: 89% confidence
Finding: The skill instructs the agent to persist `result.details.tools` from the login/provisioning response into session context and durable memory for later use. Even if the array is primarily tool metadata, it is authentication-derived state and may include privileged endpoint definitions, schemas, or other sensitive operational context that outlives the login transaction, increasing the chance of unintended reuse, leakage across tasks, or exposure to prompt/context exfiltration.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.