Chinese Pinyin Display

• Outcome: Pass
• Latest audit: May 28, 2026 · 9:02 AM UTC
• Version: 1.2.2

Overview

This skill is a local Chinese-to-pinyin formatting helper, and the scanner alerts do not show hidden commands, data theft, or unsafe persistence.

Reasonable to install if you want strict two-line pinyin formatting for Chinese learning conversations. Review your npm dependency policy, and enable the skill only when you want its child-mode formatting to continue until an explicit exit phrase is used.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Hidden Instructions

High

• Category: Prompt Injection

Content

- Pinyin and Chinese lines must have **identical structure** (same punctuation, same spacing pattern) / 拼音行和汉字行结构必须完全一致（标点、间距位置相同）
- Each character/symbol occupies one position on both lines / 每个字符在两行各占一个位置
- **Emoji handling / 表情符号处理：** Emoji appears unchanged in both lines (pinyin line + Chinese line) / 表情符号原样显示在两行中
- ⚠️ **Emoji Alignment Limitation / 表情符号对齐限制：** Multi-codepoint emojis (flags 🇺🇸, skin tones, some ZWJ sequences 👨‍👩‍👧) may cause misalignment because they render as 2+ characters wide in some terminals but occupy a single character position in the logic. For best results, use single-codepoint emojis like 😀 👍 🎉 🦞
- **Fallback for rare characters / 生僻字处理：** Characters not in the override dictionary use pinyin-pro directly; if pinyin-pro returns empty or non-standard result, the character itself is shown as-is / 不在词典中的字使用 pinyin-pro 直接查询；如果返回空或非标准结果，则保留原字符
- Use for children learning Chinese and pinyin / 适用于儿童中文和拼音学习

• Confidence: 60% confidence
• Finding: ‍

Hidden Instructions

High

• Category: Prompt Injection

Content

- Pinyin and Chinese lines must have **identical structure** (same punctuation, same spacing pattern) / 拼音行和汉字行结构必须完全一致（标点、间距位置相同）
- Each character/symbol occupies one position on both lines / 每个字符在两行各占一个位置
- **Emoji handling / 表情符号处理：** Emoji appears unchanged in both lines (pinyin line + Chinese line) / 表情符号原样显示在两行中
- ⚠️ **Emoji Alignment Limitation / 表情符号对齐限制：** Multi-codepoint emojis (flags 🇺🇸, skin tones, some ZWJ sequences 👨‍👩‍👧) may cause misalignment because they render as 2+ characters wide in some terminals but occupy a single character position in the logic. For best results, use single-codepoint emojis like 😀 👍 🎉 🦞
- **Fallback for rare characters / 生僻字处理：** Characters not in the override dictionary use pinyin-pro directly; if pinyin-pro returns empty or non-standard result, the character itself is shown as-is / 不在词典中的字使用 pinyin-pro 直接查询；如果返回空或非标准结果，则保留原字符
- Use for children learning Chinese and pinyin / 适用于儿童中文和拼音学习

• Confidence: 60% confidence
• Finding: ‍

Unpinned Dependencies

Low

• Category: Supply Chain

Content

{
  "dependencies": {
    "pinyin-pro": "^3.28.0"
  }
}

• Confidence: 40% confidence
• Finding: "pinyin-pro": "^3.28.0"

VirusTotal

No VirusTotal findings

Static analysis

No suspicious patterns detected.