YingDao-GuoKe

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:32 PM UTC
• Version:
  1.0.0

Overview

This skill does what it advertises: it stores a Yingdao profile identifier locally and uses Yingdao APIs to show account and activity statistics.

Install only if you are comfortable storing your Yingdao UUID/personalId locally and sending those identifiers to Yingdao APIs to retrieve profile and development statistics. Do not provide passwords or API keys; the skill does not need them. To remove the binding, delete the skill's local data/user.json file.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly instructs collection and storage of a user's community profile link, UUID, and derived personalId, and says the system will remember these identifiers for future use, but it does not provide a clear privacy notice, consent flow, retention policy, or storage/security details. These identifiers enable repeated lookup of account and activity data, so silent persistence increases privacy risk and may surprise users.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill describes querying external Yingdao APIs to retrieve profile and achievement statistics, including account metadata and usage/activity metrics, but does not clearly warn users that their identifiers will be sent to third-party endpoints and that potentially sensitive profile statistics will be returned. This lack of transparency can expose personal data unexpectedly and undermines informed consent.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill sends user identifiers (UUID/personalId) to api.yingdao.com to validate and query account data, but the code contains no user-facing notice, consent flow, or minimization around this transmission. Because these identifiers are tied to a user's community profile and stats, undisclosed transmission creates a privacy risk even if the destination is the expected service API.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill persists user binding data in a local JSON file without any disclosure, retention policy, or protection controls visible in the code. Storing userId-to-UUID/personalId mappings on disk creates a privacy exposure if the host is shared, backed up, or compromised, because account associations can be recovered later.

VirusTotal

64/64 vendors flagged this skill as clean.