China Electronic Components Suppliers

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:22 PM UTC
• Version:
  1.0.1

Overview

This is a local supplier-reference skill with no hidden execution, network access, credential use, or persistence, but its documentation understates that the bundled data includes company contact emails.

Safe to install from a code-security standpoint. Before using it for procurement or outreach, verify supplier details and contact channels independently, and be aware that the package includes direct company contact emails despite its documentation saying it only contains cluster-level intelligence.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The file goes beyond a general industry guide by publishing a structured list of specific factories along with direct contact email addresses. In an agent skill, this can be used to enable unsolicited outreach, targeted spam/phishing, vendor impersonation, or automatic procurement workflows against third parties who did not necessarily consent to being included in an actionable contact database.

VirusTotal

65/65 vendors flagged this skill as clean.