Security audit

coding-as-dressing

Security checks across malware telemetry and agentic risk

Overview

This is a simple educational skill that explains code with clothing analogies and does not request sensitive access or execution authority.

Safe to install if you want beginner code explanations using clothing metaphors. Be aware it may activate on some ordinary simple code-explanation prompts and may tend to answer in Chinese; users who need tighter behavior should prefer a version that only triggers when a clothing/outfit analogy is explicitly requested and follows the user's requested language.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The trigger conditions are broad enough to activate on generic requests like '这段代码什么意思' or '帮我用简单的话解释', which are not specific to the dressing metaphor skill. This can cause unintended routing or override a more appropriate general-purpose coding explainer, leading to prompt-selection confusion and reduced reliability of agent behavior.

Natural-Language Policy Violations

Medium

Confidence: 88% confidence
Finding: The skill content and style guidance are written to always respond in Chinese and do not provide any user language choice. In multilingual environments this can produce incorrect or inaccessible output, causing instruction hijacking at the UX layer where the skill's formatting constraints override the user's explicit language preference.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.