跨境 Listing 生成器

Security checks across malware telemetry and agentic risk

Overview

This is a non-executable helper for drafting cross-border e-commerce listings, with some accuracy and trademark caveats but no hidden access or unsafe behavior found.

Safe to install as a drafting aid. Users should confirm the target marketplace, country, language, platform policy, certifications, and pricing assumptions before publishing, and should avoid using competitor brand names or protected trademarks unless they are authorized.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The trigger conditions are broad enough to overlap with common writing, translation, optimization, and analysis requests, which can cause the skill to activate outside its intended cross-border listing workflow. That increases the chance of unintended instruction injection into unrelated conversations, incorrect task routing, or unnecessary loading of platform-specific guidance that may alter the assistant’s behavior.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The phrase about translating or localizing an existing listing to another language is especially broad because it can match ordinary translation requests that are not actually e-commerce listing tasks. In an agent setting, that ambiguity can misroute user intent, invoke the skill inappropriately, and expose downstream behaviors such as default platform assumptions or reference-file loading when they are not warranted.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal