Security audit
auto-pub
Security checks across malware telemetry and agentic risk
Overview
This skill is not malicious, but it asks an agent to automatically place content into a WeChat Official Account draft box without clearly explaining the required account access or approval boundary.
Review before installing. Use this only with a test or low-risk WeChat Official Account until the publisher documents exactly how drafts are created, what account access is required, where any session or credential is stored, and how each draft submission can be approved, cancelled, audited, and revoked.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
65/65 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.