Security audit

Chance Dlt Predictor

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed lottery-analysis skill; the main risk is gambling-related advice, not malware or hidden access.

Install only if you want lottery-analysis assistance. Treat all recommendations as entertainment, set a strict budget, do not chase losses, and be aware the broad triggers may activate on general lottery-related requests.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The trigger list includes generic English phrases such as "lottery," "number selection," and "lottery analysis," which can match ordinary user queries outside the intended narrow scope. This increases the chance of unintended skill activation, causing the agent to respond with gambling-oriented guidance when the user did not explicitly request this specialized skill.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: Conversational Chinese activators like "帮我选大乐透" and "推荐大乐透号码" are broad imperative phrases that can trigger on casual requests without confirming user intent, jurisdictional appropriateness, or gambling-safety boundaries. In a gambling-related skill, over-broad activation is more sensitive because it can steer users directly into betting assistance content.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The trigger phrase includes broad natural-language requests like '帮我分析大乐透' or '推荐大乐透号码', which are common user utterances and can activate the skill without strong scoping or confirmation. That makes unintended routing more likely, especially in mixed-domain conversations, causing the assistant to enter gambling-advice behavior when the user may only be asking generally about lotteries or data analysis.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The shortcut list contains ambiguous single-word triggers such as '稳健型', '遗漏分析', '频率分析', '蒙特卡洛', and '代码', which can appear in ordinary conversation outside this skill's intended context. If matched loosely, these terms may hijack unrelated conversations or cause the assistant to produce gambling-related outputs or code unexpectedly.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The document gives highly specific lottery-selection and staking heuristics, presents probability-style claims and filtering thresholds, and may create a misleading impression that these methods materially improve winning chances. Although it includes a late brief note about budgeting, it lacks an upfront disclaimer that lottery outcomes are random and that these strategies do not reliably increase expected returns, which can encourage risky financial behavior.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.