Cn Lead Safety

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:41 PM UTC
• Version:
  0.8.2

Overview

This skill is a disclosed local quality-check layer for Chinese-market lead intelligence, with no hidden installation, persistence, credential access, or data exfiltration behavior found.

Installers should treat this as a helpful citation gate, not a complete financial-intelligence safety system. Use the verifier for markdown citation checks, but do not assume it automatically validates Chinese typos, lexicon usage, source-tier ordering, or whether missing data was fabricated.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: A safety skill that claims to enforce multiple controls but in practice only performs a narrower citation-gating function creates a dangerous false sense of assurance. Users may rely on it to prevent fabrication, source-tier violations, or encoding issues that it does not actually detect, causing unverified or misleading financial intelligence to pass downstream workflows.

VirusTotal

66/66 vendors flagged this skill as clean.