product-compare

Security checks across malware telemetry and agentic risk

Overview

This is an instruction-only product comparison helper with disclosed web-review research and no evidence of code execution, persistence, credential access, or harmful behavior.

Safe to install as a product-research aid. Treat its buying advice as a starting point, and verify sources, prices, review authenticity, and any external-platform claims before making purchase decisions.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The trigger list includes broad, everyday phrases such as '推荐', '哪个好', and '对比' that can appear in many unrelated user requests. This can cause unintended skill activation, leading the agent to invoke shopping/comparison behavior outside the user's intent and potentially expose the user to biased recommendations or unnecessary tool use.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal