Security audit
Xhs Crafter
Security checks across malware telemetry and agentic risk
Overview
This skill is a disclosed local Markdown-to-image workflow with optional external image search and cloud upload only after user consent.
Installers should understand that the default workflow is local, but choosing external image search or AI image generation sends search terms or prompts to outside services, and enabling Feishu sync uploads generated PNG and text files to cloud storage. Avoid optional upload for unpublished, sensitive, or proprietary articles unless that data flow is acceptable.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
64/64 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.