BigFish · 钓鱼AI助手（钓点分析·天气鱼情·出钓记录）

• Outcome: Pass
• Latest audit: May 27, 2026, 1:42 PM
• Version:
  0.1.1

Overview

This is a simple fishing assistant skill with no executable code, dependencies, credentials, or hidden high-impact behavior.

Safe to install for fishing assistance. Be aware it may activate on short or ambiguous Chinese fishing-related phrases, and only share location or fishing-log details you are comfortable using in the conversation.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger list includes short, common phrases such as “钓鱼”, “钓点”, and “出钓” that are broad enough to match ordinary conversation outside a clear fishing-assistant intent. This can cause unintended activation, leading the skill to process irrelevant user content or override routing to more appropriate skills, which is a real safety and quality issue even without obvious malicious intent.

VirusTotal

64/64 vendors flagged this skill as clean.