business-opportunity-insight

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:19 PM UTC
• Version:
  1.0.0

Overview

This is an instruction-only skill for Chinese business-opportunity analysis, with a broad trigger but no code, credentials, persistence, or hidden data handling.

Install this if you want a Chinese-language helper that may proactively turn commercial-looking links or ideas into startup analysis. Review its business advice critically, and be aware it may activate on loosely commercial content even when you did not explicitly ask for a full opportunity report.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The skill is configured with very broad activation criteria such as triggering whenever a user shares anything with possible commercial value, even without explicitly asking for business-opportunity analysis. This can cause inappropriate auto-invocation on ordinary messages or links, leading to over-collection of user context, irrelevant steering of conversations, and increased prompt-surface for downstream misuse.

VirusTotal

65/65 vendors flagged this skill as clean.