云集返利助手

• Outcome: Pass
• Latest audit: May 29, 2026, 8:32 PM
• Version:
  0.1.0

Overview

This is a simple Yunji shopping and rebate helper with disclosed promotional intent and no code, credentials, persistence, or automatic account actions.

Install this only if you want Yunji rebate or affiliate shopping help. Treat outputs as promotional shopping guidance, verify prices and commissions independently, and disclose affiliate or commission relationships before sharing generated promotion links or marketing material.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger list contains broad terms such as “云集” and “yunji” that can match ordinary shopping-related conversation, causing the skill to activate in contexts where the user did not clearly intend to invoke it. This can lead to incorrect routing of user requests, unintended commercial recommendations, and over-collection or misuse of shopping intent within a commerce-oriented skill.

VirusTotal

63/63 vendors flagged this skill as clean.