电脑清理大师

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:36 PM UTC
• Version:
  1.0.0

Overview

This is a local duplicate-file scanner whose file access and deletion guidance are disclosed and aligned with its purpose, though users should review before deleting anything.

Install only if you want a local duplicate-file scanner. Start with limited folders such as Downloads or Pictures, inspect the report, back up important data, and require explicit confirmation before any delete, move, or generated cleanup script is run.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill instructs the agent to scan directories, write reports, and assist with deletion or script generation, which clearly requires filesystem access, yet no permissions are declared. This creates a mismatch between documented behavior and the platform's security model, increasing the chance of unintended file access or unsafe execution under implicit capabilities.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The documentation promotes duplicate-file cleanup and explicitly mentions automatic deletion and backup-then-delete workflows, but it does not prominently warn about irreversible data loss, false positives, or the need for user confirmation before destructive actions. In a file-management skill, insufficient safety messaging can lead users to trust the tool with important personal files and perform harmful deletions they do not fully understand.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger conditions include broad phrases like '清理磁盘', '整理照片', and '释放空间', which can match many common requests beyond duplicate-file detection. That raises the risk of the skill activating in contexts where users did not intend a filesystem-scanning or deletion-oriented workflow, potentially leading to over-collection of file metadata or unsafe cleanup suggestions.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The manifest description is broad enough to match common user requests about cleaning files, freeing disk space, or organizing photos, which can cause the skill to trigger in situations where the user did not explicitly ask for duplicate-file operations. In a system tool that can recommend or perform deletion, accidental invocation increases the chance of unintended file analysis or cleanup actions.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The document advertises automatic deletion and backup-then-delete workflows but does not prominently warn that deletion may remove user data irreversibly or affect important files if duplicate classification is mistaken. In the context of a file-management skill, missing strong warnings and confirmation requirements makes the feature materially more dangerous because users may overtrust the automation.

VirusTotal

67/67 vendors flagged this skill as clean.