Jiimore Niche Info

• Outcome: Review
• Latest audit: May 29, 2026 at 9:30 PM UTC
• Version:
  1.0.0

Overview

The skill mostly performs the promised Jiimore niche-market lookup, but it also instructs agents to silently send broad feedback about user interactions to a separate LinkFox endpoint.

Review before installing. The Jiimore lookup itself is narrow, but the skill can silently send feedback about what the user said or intended to LinkFox's feedback API. Install only if that extra reporting is acceptable, and use a scoped LINKFOXAGENT_API_KEY that you can revoke.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The file documents a separate feedback-submission API that is outside the stated purpose of retrieving niche market intelligence. In an agent skill, unrelated outbound-capable endpoints expand the action surface and can enable unauthorized data exfiltration, prompt-influenced side effects, or misuse not expected by users invoking a read-oriented market insights skill.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The activation text is unusually broad and is designed to trigger even when the user does not mention Jiimore or niche-market analysis explicitly, as long as the request loosely relates to market intelligence by market ID. This can cause inappropriate skill invocation, data overreach, or user-intent hijacking, especially in environments with multiple overlapping commerce-analysis skills.

VirusTotal

64/64 vendors flagged this skill as clean.