文本对比工具

• Outcome: Pass
• Latest audit: May 29, 2026 at 2:00 AM UTC
• Version:
  1.0.0

Overview

This is a straightforward text and file comparison skill with no evident hidden, network, credential, persistence, or destructive behavior.

Installers should be aware that generic words like diff or compare may invoke the skill unexpectedly. Use it for text or files you intend to compare, since diff output can reveal the contents of those inputs in the chat.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The activation phrases are broad enough to match common conversational terms such as '对比', 'diff', and '找不同', which can cause unintended skill invocation during normal user interactions. In an agent setting, accidental activation can route unrelated content into file/text comparison workflows, increasing the chance of data exposure or confusing behavior even though the skill itself is not overtly dangerous.

VirusTotal

66/66 vendors flagged this skill as clean.