Security audit

维修工

Security checks across malware telemetry and agentic risk

Overview

This repair skill is not malware, but it needs review because it can give under-scoped DIY instructions for hazardous electrical, chemical, gas-adjacent, and vehicle brake work.

Review carefully before installing. Use it only as a high-level troubleshooting aid, and do not rely on it for electrical wiring, gas leaks or gas-line work, microwave/high-voltage repairs, chemical drain cleaners, refrigerant work, or vehicle braking systems unless qualified; prefer licensed professionals for those cases.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The manifest-level trigger keywords are very broad (e.g., 'fix', 'broken', 'not working', 'maintenance') and can match many ordinary user requests outside the intended repair domain. This increases the chance of unintended invocation, causing the wrong skill to intercept requests and potentially provide unsafe repair guidance in contexts where a more specialized or safer skill should handle the task.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The activation conditions rely on generic fault/help intents like '坏了怎么办' and '帮我看看XX' without clear boundaries or negative examples. In practice, this ambiguity can cause over-triggering on vague support requests and route users into repair workflows that may generate hazardous DIY instructions before the correct context is established.

Missing User Warnings

High

Confidence: 95% confidence
Finding: The knowledge base gives actionable DIY instructions for hazardous appliance repair, including gas and mains-powered electrical equipment, while only providing warnings for a few isolated cases. In a repair assistant skill, users are likely to treat these steps as endorsed guidance, which increases the risk of electric shock, fire, gas leak escalation, or unsafe misdiagnosis when broad safety gating is missing.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The section recommends use of adhesives and related chemicals such as AB胶, 502, 环氧树脂, 结构胶, UV胶, and glass sealants, but it does not give baseline precautions about ventilation, skin/eye protection, curing fumes, flammability, or keeping products away from children and food-contact surfaces. In a general repair skill aimed at household users, omission of these safety controls can lead to preventable exposure injuries or unsafe application in living spaces.

Missing User Warnings

High

Confidence: 96% confidence
Finding: The file provides DIY guidance for e-bike and bicycle brake adjustment and replacement, and nearby vehicle troubleshooting content may normalize self-service on transport systems. Even though it warns that car braking systems must go to a正规修理厂, the e-bike and bicycle brake entries still give actionable repair steps without a strong competency threshold, post-repair testing guidance, or escalation warning, creating risk of brake failure and serious injury.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The content recommends using chemical drain cleaners and only warns not to mix products because they may explode, but it omits broader safety guidance about caustic burns, toxic fumes, incompatibility with certain pipes, and the danger of using plungers/snakes after chemicals are added. In a repair skill, users are likely to treat this as actionable DIY advice, so incomplete warnings materially increase injury risk.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The file gives step-by-step instructions for replacing outlets and switches, which is hazardous electrical work, while the warning is limited to turning off the breaker and testing for power. It does not clearly restrict this procedure to qualified users or emphasize risks such as miswiring, shock, electrocution, fire, and noncompliance with local electrical codes, making the guidance unsafe in a general consumer repair skill.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.