Exwind Monitor

• Outcome: Pass
• Latest audit: May 28, 2026 at 7:26 AM UTC
• Version:
  1.0.0

Overview

This skill transparently checks a public EXWIND page on a schedule and sends update text to Feishu when new posts appear.

Install only if you want automatic EXWIND checks every 10 minutes and Feishu notifications. Verify that the Feishu destination and local agent-browser tool are the ones you expect; the /tmp state file can be deleted to reset duplicate tracking.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def run_cmd(cmd: str, timeout: int = 30) -> tuple[bool, str]:
    try:
        result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=timeout)
        return result.returncode == 0, result.stdout + result.stderr
    except Exception as e:
        return False, str(e)

• Confidence: 92% confidence
• Finding: result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=timeout)

VirusTotal

VirusTotal findings are pending for this skill version.