tech-report-skill

• Outcome: Review
• Latest audit: Aug 13, 2026 · 8:35 AM UTC
• Version: 1.0.0

Overview

The skill does the advertised report generation, but it also runs topic-selected Python configuration code and performs automatic network/package actions that need careful review before installation.

Review and trust any topic config files before use, because selecting a technology topic can execute matching Python files. Prefer running in a virtual environment, pin dependencies, and disable or approve network access for package installation and the Unsplash image fetch if you need an offline or controlled workflow.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (17)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill declares no permissions, yet the documented workflow clearly involves shell execution, file writes, and network access. This is dangerous because users and policy layers cannot accurately assess or constrain what the skill will do before execution, increasing the chance of unexpected local modification or outbound connections.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented purpose frames the skill as local Excel-driven report generation, but the behavior expands to external network downloads, dynamic execution of local Python config files, and insertion of prewritten content not derived from the input dataset. This mismatch is dangerous because operators may trust the tool with sensitive patent data under false assumptions about isolation, determinism, and provenance of generated content.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The documented `download_hero_image()` behavior introduces outbound network access to fetch an external image at report-generation time, which exceeds the stated local Excel-to-HTML scope of the skill. Even though the URL is hardcoded and appears benign, this expands the trust boundary, can leak environment metadata such as IP/user-agent/network egress, creates a supply-chain/dependency risk on third-party content, and may violate offline or restricted execution expectations for agent skills.

Description-Behavior Mismatch

Medium

• Confidence: 80% confidence
• Finding: The skill claims it can fetch background images and use MCP/real-time retrieval, while most of the rest of the document presents a purely local Excel-based workflow. Inconsistent capability boundaries are risky because users may unknowingly expose data to external services or depend on outputs whose source and trust model are unclear.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The script makes an outbound network request to download a hero image from Unsplash even though the advertised workflow is local Excel-to-HTML report generation. This introduces undeclared data flow and a privacy/supply-chain risk: running the skill leaks execution metadata/IP to a third party and makes output depend on remote content availability.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code constructs a Python filename from the user-supplied tech_topic and executes it via importlib, which is effectively arbitrary code execution if an attacker can influence the topic value or place files in the config directory path. Because the skill's stated purpose is report generation, executing topic-derived Python is unnecessarily dangerous and expands the trust boundary from data files to executable code.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: This second loader repeats the same unsafe pattern for keyword configuration, executing Python code chosen from user-influenced input. An attacker who can steer tech_topic or plant a crafted config file can run arbitrary code during report generation, compromising the host environment.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: The script automatically installs Python packages at runtime via pip, which exceeds the narrowly expected behavior of converting an Excel input into a report. This introduces supply-chain and environment-modification risk: executing package installation can change the host system, pull unpinned code from external indexes, and run package install hooks without explicit user approval.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The script dynamically imports a Python file derived from the user-controlled `tech_topic` value and executes it with `exec_module`, which means any code inside that file runs immediately, not just keyword data loading. In this skill context, the input is supposed to be a report-generation topic, so turning it into executable code unnecessarily expands attacker control and can lead to arbitrary code execution if an attacker can place or influence files in the config directory or abuse path construction.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill does not prominently warn that it may modify the input Excel in place and write outputs into the source directory. This is dangerous because users may run it on valuable working files or shared locations and suffer unintended data alteration, overwrite, or disclosure through generated artifacts.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The report generation behavior includes downloading external images and embedding them into HTML, but this side effect is not clearly warned in the main description. This is dangerous because it creates unannounced outbound network activity and mixes third-party content into deliverables, which may violate privacy, compliance, or reproducibility expectations.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: These lines execute a dynamically selected Python config file without any disclosure to the user that choosing a topic can trigger code execution. The lack of transparency increases risk because operators may treat the input as simple content selection, not as selection of executable code, making accidental execution of unsafe files more likely.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: Installing dependencies without prior warning or consent is unsafe because it causes unexpected network access and system modification during normal skill execution. In Python ecosystems, pip installation may fetch untrusted or compromised packages and can execute build/install scripts, making this a meaningful security concern rather than just a usability issue.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The invocation example "请用XX技术主题生成研发简报" is very broad and provides no trigger boundaries, exclusions, or confirmation step, which can cause the skill to activate in unintended contexts. In an agent environment, overly generic activation phrasing increases the chance of accidental execution on unrelated user content or prompt-injected text, leading to unintended processing of local files and report generation workflows.

Session Persistence

Medium

• Category: Rogue Agent

Content

fi

# 创建目录
mkdir -p "$(dirname "$INSTALL_DIR")"

# 复制文件
echo "正在安装文件..."

• Confidence: 80% confidence
• Finding: mkdir -p "$(dirname "$INSTALL_DIR")" # 复制文件 echo "正在安装文件..." cp -r "$(dirname "$0")" "$INSTALL_DIR" # 设置执行权限 chmod +x "$INSTALL_DIR/scripts/"*.sh chmod +x "$INSTALL_DIR/scripts/"*.py # 检查Python环境 i

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pandas>=2.0.0
openpyxl>=3.1.0

• Confidence: 94% confidence
• Finding: pandas>=2.0.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pandas>=2.0.0
openpyxl>=3.1.0

• Confidence: 94% confidence
• Finding: openpyxl>=3.1.0

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/generate_report.py:45

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/tag_relevant.py:30