hanyilong first skill

• Outcome: Pass
• Latest audit: May 28, 2026 at 9:49 AM UTC
• Version:
  1.0.0

Overview

This is an unfinished hello-world template skill with no meaningful system access or harmful behavior.

Safe to install from a security perspective, but it appears unfinished and may not be useful until the author replaces the TODO sections with a clear purpose, activation guidance, and real implementation.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: The skill description is so generic ('this is my hello world skill') that it does not define when the skill should or should not be invoked. In agent systems, vague activation scope can cause the skill to be selected in unintended contexts, increasing the chance of inappropriate behavior, privilege misuse, or unsafe execution of any future resources/scripts added to the skill.

VirusTotal

66/66 vendors flagged this skill as clean.