DevTrace-Lite - 技术决策五算子

Security checks across malware telemetry and agentic risk

Overview

This skill is an instruction-only engineering decision checklist with no code execution, credentials, persistence, or data access.

Install this if you want technical decisions to follow a compact risk-and-dependency checklist. Be aware that its broad trigger may shape many engineering conversations, so review important production or architecture recommendations before acting on them.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The trigger condition is very broad, using common conversational prompts like '要不要做/怎么做/为什么出故障', which can cause the skill to activate in many unrelated situations. This increases the chance of unintended routing or prompt injection exposure because the skill may take over conversations outside its intended technical-decision scope.

VirusTotal

No VirusTotal findings

View on VirusTotal