运营策划技能

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:25 PM UTC
• Version:
  1.0.0

Overview

This is a coherent operations-planning template skill, but users should apply privacy and approval controls before using its analytics or external-tool examples.

Install as a planning and template skill. Before connecting Google Analytics, Sensors, Notion, Trello, Asana, Zapier, Make, or social-media accounts, confirm the exact data fields, credential scopes, destination services, retention period, and approval steps. Do not copy the tracking examples into production without privacy notice, consent where required, data minimization, and restricted access.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger conditions are overly broad and map to common terms like '运营策划', '活动策划', and '产品运营', which could cause the skill to activate for many general requests beyond the user's intent. In an agent ecosystem, unintended invocation can expose the model to unnecessary instructions, increase prompt-surface area, and cause workflow hijacking or confusing task routing.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This section encourages analytics collection of age group, user type, geography, interests, behavioral events, and conversion data without any privacy notice, minimization guidance, consent requirements, or retention controls. In an operations-planning skill, these examples may be copied directly into real deployments, leading to over-collection of personal and potentially sensitive behavioral data and creating compliance and privacy risk.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The document recommends collecting detailed registration, browsing depth, conversion-path, and payment-completion data but omits warnings about handling sensitive user activity data, purpose limitation, and transparency obligations. Because this skill is designed for community/content-platform operations, such guidance can normalize invasive funnel surveillance and increase the chance of unsafe data practices at scale.

Vague Triggers

Low

• Confidence: 88% confidence
• Finding: The description is overly broad and does not define clear activation boundaries, exclusions, or misuse-resistant constraints. In a skill that can generate plans, analyze data, and manage projects across multiple operational domains, this increases the chance of unintended invocation, scope creep, or the model being steered into performing sensitive or risky tasks without sufficient guardrails.

VirusTotal

65/65 vendors flagged this skill as clean.