Security audit

BLX Lobster Sticker

Security checks across malware telemetry and agentic risk

Overview

This is a low-risk instruction-only sticker skill that maps chat emotions to local image files, though it may send stickers unexpectedly on common phrases.

Install this only if you want automatic sticker responses in chat. Test it in a low-stakes conversation first because common phrases like thanks, okay, or surprised reactions may trigger images; also verify the referenced image assets exist and that you are comfortable with the artwork licensing/provenance.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The skill is designed to auto-send stickers based on user language, but the description and mapping rely on very broad emotional keywords that commonly appear in ordinary conversation. This can cause unintended activations, leading to incorrect responses, user confusion, and reduced reliability of the assistant, especially in customer-facing contexts where precision matters.

Vague Triggers

Medium

Confidence: 96% confidence
Finding: Many trigger phrases in the mapping are highly generic terms such as common acknowledgments, reactions, or emotional words, so normal conversation can accidentally match multiple stickers. In an automated assistant, this creates unsafe behavior at the UX/policy layer by causing unsolicited media output and misclassification of user intent, though it does not appear to enable code execution or data exfiltration.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The skill is designed to auto-send stickers based on broad emotional expressions, which can be triggered during ordinary conversation without an explicit user request for media. In a chatbot or customer-support setting, this can cause unintended actions, noisy responses, and reduced user control, especially because many emotions are inferred from common language rather than a clear command.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The trigger list contains very common phrases such as '谢谢', '哇', and other generic expressions that appear frequently in normal conversation. This makes accidental activation highly likely, causing the assistant to send images when the user did not intend to invoke the skill, which can disrupt workflows and degrade trust in the agent.

Vague Triggers

Medium

Confidence: 78% confidence
Finding: The trigger keywords are broad, ambiguous, and overlap with ordinary conversation, which can cause the skill to activate unexpectedly and send images when the user did not intend to invoke it. In a chatbot or customer-support setting, this can disrupt responses, create confusing behavior, and potentially interfere with higher-priority instructions or user workflows.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger keywords are broad, common conversational terms such as '好的', '谢谢', '什么鬼', and emotional words that appear in ordinary chat. In an auto-invocation setting, this can cause unintended sticker sending, producing spammy behavior, incorrect responses, or user-manipulable invocation through crafted phrasing.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.