Taobao Draft Generator
Security checks across malware telemetry and agentic risk
Overview
The skill does not appear to steal data or publish to Taobao, but it overstates its compliance checks and can write files outside the intended product folder if given unsafe input.
Install only if you treat it as a local draft formatter, not a compliance auditor. Manually verify title originality, forbidden words, material consistency, category, price, and stock before publishing, and use simple product IDs without slashes or path traversal characters.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
66/66 vendors flagged this skill as clean.