eden-digital-web3-weekly-digest-yang

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:29 PM UTC
• Version:
  8.0.0

Overview

This skill fetches public Web3 market and news data to generate a local weekly report, with no evidence of credential access, persistence, or harmful behavior.

Reasonable to install if you want automated Web3 weekly reports. Be aware it may activate on broad Web3 weekly-report phrasing, runs local Python that fetches public web data, may need Playwright for the standalone DAT helper, and its financial figures and AI-completed analysis should be verified before publication.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

High

• Confidence: 94% confidence
• Finding: The skill explicitly says it should activate on very broad and ambiguous phrases such as "帮我写本周的" whenever surrounding context loosely relates to Web3, crypto, financing, RWA, or DAT. That can cause unintended invocation, leading the agent to fetch external data, generate reports, and perform multi-step actions the user did not clearly request.

VirusTotal

66/66 vendors flagged this skill as clean.