中欧贸易合规高级顾问

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:34 PM UTC
• Version:
  1.0.0

Overview

This skill is a coherent Chinese-language EU trade compliance helper that routes tax, product compliance, and certificate questions to a named compliance plugin without adding hidden install steps or local system access.

Reasonable to install if you want Chinese EU VAT and compliance assistance. Treat outputs as advisory, review the separate eu-compliance-skill plugin before submitting sensitive certificates or business documents, and be aware that generic price questions may trigger VAT calculation unless the agent asks for clarification.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The VAT trigger condition is overly broad because it includes generic phrases like “多少钱”, which can appear in many non-tax contexts. This can cause unintended plugin invocation, sending irrelevant user input into a tax/compliance workflow and producing misleading regulated advice in situations where the user did not request it.

VirusTotal

66/66 vendors flagged this skill as clean.