Security audit

马化腾

Security checks across malware telemetry and agentic risk

Overview

This is a text-only Ma Huateng biography skill, but it includes unrelated promotional links and personal contact details that could be surfaced to users.

Install only if you are comfortable with a biography skill that also contains unrelated promotional material, external service links, and a personal contact email. A cleaner version should remove or clearly separate that section so answers about Ma Huateng do not advertise unrelated projects.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Description-Behavior Mismatch

Medium

Confidence: 98% confidence
Finding: The skill is presented as a Ma Huateng biography skill, but it contains unrelated promotional material, external links, and personal contact details. This creates instruction/data boundary confusion and can cause the agent to surface unauthorized promotion or route users toward irrelevant third-party resources under the guise of a trusted biography skill.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: Embedding unjustified project promotion and external service references in a biography skill introduces a covert redirection risk: users asking about Ma Huateng could be steered to unrelated domains and services. Even without explicit code execution, this is dangerous because it abuses the skill's trust context for advertising, traffic diversion, or social engineering.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.