Security audit

返利全能助手

Security checks across malware telemetry and agentic risk

Overview

The skill appears to be a shopping/cashback helper, and the flagged behavior is mostly aligned with that purpose, but users should be mindful that it may handle purchase and order information.

Install only if you are comfortable letting the skill process shopping, order, and cashback-related details. Avoid sharing account credentials or unnecessary purchase history, and prefer using it only when you explicitly want cashback or order-tracking help.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The trigger list includes broad, everyday-shopping phrases such as '购物省钱' and generic cashback terms that can cause the skill to activate in contexts far beyond explicit cashback intent. Overbroad invocation increases the chance of unintended collection or processing of shopping preferences, order details, and behavioral data from users who did not mean to engage this skill.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill describes tracking shopping history, order status, and cashback progress but does not warn users that these actions involve potentially sensitive commerce and behavioral data. Without clear disclosure, users may not understand what data is accessed, retained, or shared, creating privacy and consent risks if the skill is deployed or integrated with external platforms.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.