Blog Polish Zhcn Images

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:19 PM UTC
• Version:
  1.0.6

Overview

This skill locally polishes a blog draft and saves the resulting Markdown and image prompts, with no evidence of hidden sharing or destructive behavior.

Install this if you want a local workflow that reads a blog draft and writes polished output files. Before running it, confirm the draft path is not sensitive and choose an output directory where generated Markdown and image files can be safely created.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The skill persistently writes files to the user's home-directory workspace without a clear user-facing warning or confirmation boundary. In agent environments, implicit filesystem modification can surprise users, overwrite prior work, or create unintended durable artifacts, especially when activation criteria are broad.

VirusTotal

66/66 vendors flagged this skill as clean.