机票产品需求评审

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:31 PM UTC
• Version:
  1.0.0

Overview

This is a coherent Convex performance-audit skill with disclosed, purpose-aligned behavior and no hidden execution or persistence.

Safe to install for Convex performance work. Before letting it run diagnostics, confirm the target deployment and avoid using production Convex credentials unless you intentionally want production insights reviewed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The default prompt uses broad natural-language phrasing that directly invokes the skill by name and action, which can increase the chance of unintended activation when nearby user text resembles a trigger phrase. In an agent environment, ambiguous activation can cause the wrong skill to run on untrusted content, leading to incorrect processing or accidental disclosure of context to the skill.

VirusTotal

64/64 vendors flagged this skill as clean.