Security audit

AI 开源项目技术尽调与公众号内容自动化

Security checks across malware telemetry and agentic risk

Overview

The skill is not deceptive, but it can automate public WeChat publishing and Feishu knowledge-base creation without clear approval gates.

Review this before installing if the connected WeChat or Feishu accounts can post or store real organizational content. Use it in draft-only mode unless you have explicitly configured review, approval, and rollback procedures, and avoid pointing it at private or sensitive repositories unless you are comfortable with the resulting analysis being sent to the configured external services.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The README describes an end-to-end pipeline that culminates in public WeChat article publishing, but it does not clearly warn that this step can create externally visible content or require an explicit confirmation gate before publication. In an automation context, users may invoke the skill expecting analysis and drafting only, while the skill proceeds to publish generated content, creating a real risk of accidental external disclosure, reputational damage, or posting inaccurate AI-generated material.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The scheduled automation example includes `"publish": true`, enabling unattended recurring publication without an adjacent safety warning, approval checkpoint, or guidance on dry-run mode. Because the skill generates content from external sources and then posts it automatically, this raises the chance of repeated accidental publication of low-quality, misleading, or policy-violating content at scale.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The trigger phrases are broad, natural-language requests such as asking to analyze a GitHub project or generate a technical article. This can cause the skill to activate in contexts the user may not intend, increasing the chance of unreviewed external fetching, analysis, and downstream publication actions. In this skill, the risk is amplified because activation can lead to chained processing across multiple external services.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The workflow explicitly sends repository data and generated analysis to multiple external services, but the description does not clearly warn users that repository contents, issues, contributor data, and derived reports may be transmitted onward. This creates a meaningful data-handling and privacy risk, especially if users point the skill at private, sensitive, or internal repositories or if generated content is automatically synced to knowledge bases.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The workflow description and routing are broad enough to support multiple collection and publishing modes without clearly defining activation constraints, approval gates, or when external publication should occur. In a skill that collects third-party GitHub data, generates long-form content, and pushes documents to Feishu, ambiguous trigger scope increases the risk of unintended large-scale processing or publication from loosely validated inputs.

Natural-Language Policy Violations

Medium

Confidence: 78% confidence
Finding: The manifest hard-codes Chinese-language branding and publication context, including WeChat public account generation and Chinese titles, without exposing a user language or locale control. This can cause content to be generated and published in an unintended language or jurisdictional context, which is a safety and governance issue when combined with automated external publishing and knowledge-base persistence.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.