公众号写手

• Outcome: Pass
• Latest audit: May 29, 2026, 8:32 PM
• Version:
  2.0.0

Overview

This appears to be a content-writing helper with broad activation wording but no evidence of hidden, destructive, credential-seeking, or high-impact behavior.

Install only if you want a general content-writing and optimization assistant. Because its triggers are broad, use it for explicit writing or publication tasks and review any generated or edited content before relying on it publicly.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The trigger metadata is broadly defined around common writing tasks such as article creation, optimization, and multi-platform adaptation, without clear boundaries on when the skill should or should not activate. This can cause accidental invocation during ordinary user requests, leading the agent to apply this skill unexpectedly and override more appropriate instructions or workflows.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The listed trigger scenarios are open-ended and lack activation constraints, confirmation steps, or disambiguation rules. In an agentic system, this increases the chance of misrouting benign conversations into this skill, especially because the skill has write/edit capabilities and could modify content when the user did not intend to invoke specialized publication-style behavior.

VirusTotal

65/65 vendors flagged this skill as clean.