竞品情报监控系统

• Outcome: Review
• Latest audit: May 29, 2026 at 9:34 PM UTC
• Version:
  1.0.0

Overview

This skill is unlikely to harm your computer, but it appears to sell competitor research while generating mostly generic and partly random reports.

Treat this as a Review item before installing. It does not show malware-like behavior, but do not rely on its reports for pricing, marketing, investment, or product decisions unless the publisher clearly labels the output as synthetic/template-based or adds real data collection, source attribution, and deterministic review analysis.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The skill advertises competitor analysis from a provided name/link, but the implementation never uses the URL to retrieve or validate real competitor data. This can mislead users into trusting fabricated output as evidence-based intelligence, creating integrity and decision-risk issues in a business-analysis context.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The review-analysis function always generates random sentiment results via Math.random() and ignores any actual review input, yet presents the output as analysis. In this skill’s competitor-intelligence setting, that is dangerous because it produces nondeterministic, invented business signals that may drive pricing, marketing, or product decisions.

VirusTotal

64/64 vendors flagged this skill as clean.