Security audit

发布测试风险治理

Security checks across malware telemetry and agentic risk

Overview

This skill provides a Chinese-language release risk checklist and planning template without hidden execution, data export, or persistence.

Install only if you want Chinese-language QA release governance guidance. Treat its rollback and release steps as planning checklists, not authorization to deploy or roll back production systems without normal approvals.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The trigger phrase set is broad enough that ordinary discussions about releases, risk, rollback, or emergency changes could invoke this skill unintentionally. In a governance skill, accidental activation can steer users into a rigid release workflow, produce irrelevant artifacts, or crowd out a more appropriate skill, which is a real quality/safety issue even if it does not directly execute actions.

Natural-Language Policy Violations

Medium

Confidence: 82% confidence
Finding: The skill is documented and structured as Chinese-only without offering language negotiation or user opt-in, which can cause incorrect use, misunderstanding of release decisions, and operator error in multilingual environments. Because this skill produces governance outputs such as rollback and monitoring plans, ambiguity from language mismatch can degrade decision quality and incident response.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.