personal-work-assistant

• Outcome: Review
• Latest audit: Aug 18, 2026 · 12:38 PM UTC
• Version: 1.0.0

Overview

This skill is a work-reporting assistant, but it collects private workplace messages and sends them to a hardcoded external AI endpoint with bundled credentials and weak user controls.

Review this skill carefully before installing. Only use it if you are authorized to process the relevant DingTalk groups, private chats, and Teambition data, and if your organization permits sending that content to the hardcoded external AI service. Rotate/remove bundled credentials, replace plaintext token storage with a safer secret mechanism, disable direct-message collection unless explicitly needed, and inspect or remove the cron job after setup.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill advertises capabilities that imply file access, shell execution, and network communication, but it does not declare permissions or clearly bound those powers. This reduces transparency for users and reviewers, and in a skill that reads messages, stores task data, and installs cron jobs, undeclared capabilities materially increase the chance of overreach or abuse.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The described behavior indicates raw DingTalk group chats, direct messages, and mentions may be sent to an external third-party LLM service, while the public description frames the skill as a local aggregation/reporting assistant. Sending workplace communications off-platform without explicit disclosure, combined with hardcoded external API endpoints and API keys, creates significant confidentiality, compliance, and secret-management risk.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code hardcodes a live API key and sends prompts to an external LLM endpoint. Anyone with code access can reuse the credential, and the endpoint receives sensitive workplace chat content, creating both credential exposure and third-party data exfiltration risk.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly collects 1:1 chats, group messages, @mentions, and persists a long-lived task ledger, but the description does not warn users about privacy implications, retention duration, or consent requirements. In a workplace context, this can capture sensitive business discussions and personal employee communications, making the omission materially dangerous.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: Automatically installing cron jobs and pushing reports to DingTalk without a clear warning can cause unexpected persistence and automated outbound communications. While not inherently malicious, silent scheduled execution increases operational risk because users may not realize the skill will continue running and sending data after initial setup.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The function packages group chats, @mentions, and direct messages into a prompt and posts them to a third-party API without any user-facing notice, consent, minimization, or redaction. Because this skill is a personal work assistant processing potentially confidential internal communications, the external transfer is especially sensitive.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This code collects 1:1 private-message conversation data and includes it in an automated work-reporting pipeline without any consent, disclosure, or scoped minimization visible in the collector. In the context of a 'personal work assistant' that aggregates and pushes summaries to DingTalk, private conversations may contain sensitive personal, HR, security, or customer information that can be silently ingested, retained, and redistributed beyond the original audience.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script interactively collects a Teambition user token and writes it directly into config.yaml, creating persistent plaintext credential storage. In the context of a personal work assistant that aggregates chats and tasks, compromise of that file could expose project/task data and enable unauthorized API access; additionally, the token is read with a normal prompt, so it may be visible on-screen or captured in terminal logs/screenshares.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script silently modifies the user's crontab by appending a persistent scheduled task without interactive confirmation, dry-run output, or explicit prior warning in the script itself. Even if intended for convenience, persistence mechanisms are security-sensitive because they alter future execution behavior and can be abused to maintain long-lived code execution under the user's account.

Ssd 3

High

• Confidence: 99% confidence
• Finding: This configuration explicitly enables broad surveillance-style collection of entire group chats, @all messages, and one-to-one private conversations, then persists unfinished items in a long-term task ledger and forwards a synthesized report to DingTalk. In the context of a personal work assistant, this exceeds minimally necessary data access and can capture sensitive business discussions and private communications without clear consent boundaries, creating significant privacy, confidentiality, and insider-risk exposure.

External Transmission

Medium

• Category: Data Exfiltration

Content

}

        try:
            resp = requests.post(api_url, headers=headers, json=payload, timeout=45)
            if resp.status_code == 200:
                res_data = resp.json()
                content = res_data['choices'][0]['message']['content']

• Confidence: 94% confidence
• Finding: This code performs external network transmission of collected work messages to a remote service. In this skill context, the transmission is more dangerous because the payload includes potentially sensitive enterprise communications and task data, and the destination is a non-local third-party endpoint.

Session Persistence

Medium

• Category: Rogue Agent

Content

if crontab -l 2>/dev/null | grep -Fq "$SCRIPT_PATH"; then
    echo "⚠️ 定时任务已存在，无需重复添加。"
else
    (crontab -l 2>/dev/null; echo "$CRON_JOB") | crontab -
    echo "✅ 已成功添加工作日 10:00 定时晨报任务 (Crontab)！"
fi

• Confidence: 97% confidence
• Finding: This line participates in writing a new cron entry into the user's crontab, creating persistent execution of `run_daily_assistant.sh` every weekday at 10:00. In the context of an agent skill, automatic persistence is more sensitive because it enables recurring execution of code that may process private work messages and tasks without requiring the user to manually rerun it.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: core/analyzer/task_analyzer.py:16