hk-cinema-now-playing

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:20 PM UTC
• Version:
  1.0.3

Overview

This is a small instruction-only Hong Kong cinema helper, with no code or privileged access shown.

This appears safe to install from the provided artifacts. The practical risk is incorrect routing or stale showtime data, so users should verify cinema, date, showtime, price, and destination before buying tickets.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The trigger description is broad enough to activate on generic requests about Hong Kong movies, cinema showtimes, or booking, which can cause the skill to engage outside a narrowly intended context. While this is not an exploit primitive by itself, overbroad activation can route unrelated user queries into the skill, increasing the chance of irrelevant actions, confusion, or unintended link/book-ticket flows.

VirusTotal

66/66 vendors flagged this skill as clean.