PizzINT Monitor

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:15 AM UTC
• Version: 1.1.0

Overview

This skill fetches a public PizzINT webpage and formats a report, with no evidence of credential access, persistence, local data collection, or destructive behavior.

Before installing, understand that the skill is mostly Chinese-language and may trigger on broad geopolitical terms. It contacts pizzint.watch or asks the agent to open that site in a browser to gather public OSINT-style data; treat the resulting threat report as informal correlation, not as authoritative intelligence or a basis for financial or operational decisions.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The skill documentation is primarily written in Chinese, including the description, setup context, and risk guidance, while embedding some English terms. This imposes a specific language on users without stating that the skill is Chinese-only, offering an alternative language, or requesting user opt-in, which matches the locale/language policy concern.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The natural-language instructions and usage guidance are presented exclusively in Chinese, but the document does not state that the skill is region-specific or offer an opt-in language choice. Under the stated policy, forcing a specific language without user opt-in is a locale-policy violation.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger list includes broad terms such as '军事情报' and '地缘紧张' that can match many unrelated requests, causing the skill to activate outside its intended PizzINT-specific scope. Over-broad invocation increases the chance of inappropriate use in sensitive geopolitical contexts and can route generic intelligence queries into a specialized, potentially misleading workflow.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: This Python file contains natural-language instructions and descriptions primarily in Chinese, including the module header and many user-facing messages. Under the policy rule for language/locale, forcing a specific language without user opt-in is a violation unless the locale restriction is explicitly documented and justified, which is not present here.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def get_pizzint_data():
    """从 pizzint.watch 获取数据"""
    try:
        result = subprocess.run(
            ['curl', '-s', '--max-time', '10', 'https://pizzint.watch/'],
            capture_output=True, text=True, timeout=15
        )

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Static analysis

No suspicious patterns detected.