Security audit

检查报告解读

Security checks across malware telemetry and agentic risk

Overview

This is a simple medical report reference skill with broad triggers but no code, hidden access, or persistence.

Install only if you want a lightweight educational aid for understanding imaging or ECG report wording. Because the triggers are broad and the content is medical, confirm the user is actually asking for report interpretation and rely on qualified clinicians or official reports for diagnosis, urgency, and treatment decisions.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger list includes very generic terms such as "CT", "MRI", "ECG", and "胸片", which are likely to appear in ordinary medical conversations and documents. In a medical skill, unintended invocation is more dangerous than usual because it can inject diagnostic-sounding guidance into unrelated contexts, increasing the risk of confusion or inappropriate reliance on the skill.

Natural-Language Policy Violations

Medium

Confidence: 79% confidence
Finding: The skill mixes Chinese content with English trigger terms but provides no language-selection or locale-handling policy. This can cause the skill to activate for users in the wrong language context or produce partially mismatched interpretations, which is particularly risky in a healthcare setting where misunderstanding findings or urgency labels can affect care-seeking behavior.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.