6大平台热搜聚合

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:40 PM UTC
• Version:
  1.0.0

Overview

This skill fetches public Chinese trend lists and can optionally format topic ideas, with no evidence of credential access, persistence, or hidden destructive behavior.

Install only if you are comfortable with the agent making outbound requests to the listed public trend platforms when invoked. Consider narrowing the trigger phrases locally if generic words like “热点” or “趋势” would fire too often in your workflow.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 82% confidence
• Finding: The skill advertises network-backed functionality and explicitly invokes remote APIs, but no permissions are declared. This creates a transparency and policy-enforcement gap: users and the host may not be able to accurately assess or constrain outbound network access, especially since the skill also mentions SSL verification fallback behavior.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 78% confidence
• Finding: The skill description presents the capability as simple hot-trend aggregation, but the documented behavior also includes AI-generated topic recommendations, writing angles, and content ideation. This mismatch can mislead users and reviewers about the extent of processing performed on fetched data and may cause the skill to trigger in contexts where users did not intend content-generation assistance.

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: The trigger phrases are broad, generic terms such as '热点', '趋势', and '什么火', which are common in normal conversation. Overbroad triggers increase the chance of accidental invocation, causing unsolicited network calls and unexpected behavior in conversations unrelated to this skill's intended use.

VirusTotal

67/67 vendors flagged this skill as clean.