Security audit

smartlink-ip-workbench

Security checks across malware telemetry and agentic risk

Overview

The skill is purpose-aligned for a localized SmartLink/PatSnap HTML workbench, but users should expect local file writes, backups, and localhost services.

Install this only if you are working in the intended SmartLink/PatSnap environment. It will edit a specific local HTML file, create backup/latest copies under hard-coded Downloads paths, may run localhost services on ports 8767 and 8788, and expects PatSnap/Zhihuiya MCP credentials to be configured separately.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The manifest describes building, updating, saving, and previewing local HTML workbench artifacts, which makes saving a generated file expected. However, this script also silently duplicates the source HTML into a hard-coded user Downloads backup location, which is broader behavior than simply saving a latest version alongside the source file.

Natural-Language Policy Violations

Low

Confidence: 92% confidence
Finding: The skill documentation is written entirely in Chinese and does not indicate that users may choose another language or that the skill is intentionally limited to Chinese-speaking users. Under the policy rule, a fixed language requirement without user opt-in or a documented justification is a natural-language policy concern.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The description lists a long set of loosely bounded scenarios such as patent workflows, competitor patent analysis, compliance, infringement complaints, OCR, knowledge retrieval, local HTML saving, and localhost preview, but does not clearly define trigger phrases or exclusion conditions. This breadth makes it unclear when the skill should activate versus when a more specific skill should handle the request.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The markdown directs the agent to save every meaningful HTML update to the working file, backup folder, and latest-copy path, which affects user data on disk. The document does not prominently disclose this file-writing behavior or advise the user about overwrite/backup side effects before execution.

Natural-Language Policy Violations

Medium

Confidence: 97% confidence
Finding: The instruction '用中文回答' forces a specific language for final responses. There is no opt-in mechanism or explanation that the skill is restricted to Chinese for a documented regional or compliance reason.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/verify_html_js.js:15