快递查询

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:26 PM UTC
• Version:
  1.0.0

Overview

This skill provides courier hotline lookup and delivery-issue guidance using static local data, with no hidden access, persistence, or destructive behavior found.

Reasonable to install for Chinese courier contact lookup and delivery-problem guidance. Treat phone numbers, service hours, complaint portals, and compensation rules as time-sensitive and verify important details through official carrier channels before acting.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The skill enables implicit invocation without any trigger constraints, so the agent may route unrelated user requests into this skill based only on broad semantic similarity. Because the skill is designed to provide operational guidance around courier complaints, contact channels, and scam-related issues, over-broad auto-invocation can cause unintended disclosure, misrouting, or low-trust advice being surfaced when the user did not explicitly ask for it.

VirusTotal

66/66 vendors flagged this skill as clean.