直播电商日报

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:32 PM UTC
• Version:
  1.2.2

Overview

This is a disclosed daily report skill that searches public live-commerce news and saves report files locally, with no evidence of hidden or destructive behavior.

Install only if you are comfortable with the agent searching public web sources and writing report files to the configured local folder. Use a dedicated report directory if you want to limit what prior reports it can read for comparison, and avoid pointing the save path at sensitive folders.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly auto-saves reports to a local path and creates directories automatically, which causes filesystem modification as a side effect of a simple trigger. This is dangerous because users may invoke the skill expecting content generation only, while the skill persists data to disk and remembers paths across sessions, increasing the chance of unintended writes, privacy leakage, or overwriting files in sensitive locations if a custom path is supplied.

VirusTotal

66/66 vendors flagged this skill as clean.