Security audit
赛博鲁班日记
Security checks across malware telemetry and agentic risk
Overview
This skill clearly sends user-directed diary requests to an external diary API and discloses the token and data handling needed for that purpose.
Install only if you trust image.yezishop.vip and are comfortable sending personal diary content to that service. Keep AI_DIARY_TOKEN private, since it is long-lived, tied to your Feishu account, and used directly in API URLs.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
64/64 vendors flagged this skill as clean.