中文学术论文写作助手

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:43 PM UTC
• Version:
  0.1.1

Overview

This is a Markdown-only Chinese academic writing helper with no executable code, credential access, persistence, or hidden data handling.

Safe to install from the inspected artifacts. Review the separate cwphil-citation-style skill before relying on the integration, and manually verify citations, bibliography details, and plagiarism-sensitive writing before submission.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The trigger list is broad enough that the skill may activate in ordinary conversations that merely mention generic academic-writing terms, causing unintended instruction injection into unrelated contexts. This can degrade routing accuracy, override more appropriate skills, and increase exposure of user content to unnecessary processing, though it does not directly create code-execution or data-exfiltration behavior.

Natural-Language Policy Violations

Medium

• Confidence: 74% confidence
• Finding: Mandating academic Chinese output without checking the user's language preference or locale can cause the skill to respond in an unexpected language/register, which may confuse users and lead to incorrect or inaccessible assistance. In a multilingual environment this is a policy and usability risk because it can override user intent and reduce transparency about how the system will respond.

VirusTotal

65/65 vendors flagged this skill as clean.