HTTP客户端

• Outcome: Review
• Latest audit: May 29, 2026, 2:01 AM
• Version:
  1.0.0

Overview

This appears to be an HTTP request helper, but it needs review because it can send credentials or private request data to external endpoints and keep request history without enough user-facing guardrails.

Review before installing. Use it only when you intentionally want to send a request, avoid putting secrets in headers or bodies unless you trust the endpoint, and check whether request history redacts tokens or can be disabled or cleared.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The activation phrases are very broad (e.g., 'HTTP', '发请求', '请求API') and can be triggered during ordinary conversation, causing the skill to activate unexpectedly. In the context of a tool that can send arbitrary outbound requests with headers and authentication, accidental activation raises the risk of unintentional data transmission to external services.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill advertises support for custom headers, bodies, authentication, and request history, but does not clearly warn that it can transmit sensitive data and credentials to external endpoints and retain metadata locally. This omission is dangerous because users may provide tokens or private data without understanding that they will be sent off-system and partially logged in history.

VirusTotal

65/65 vendors flagged this skill as clean.