Antique

Security checks across malware telemetry and agentic risk

Overview

This is a text-only skill with mismatched and vague instructions, but it does not install code, request credentials, or perform actions on its own.

Install only if you are comfortable treating it as loose guidance rather than a well-scoped antique appraisal skill. Verify any real-time queue, reservation, parking, navigation, or venue information through trusted sources, and avoid sharing precise location unless needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The manifest advertises an antique appraisal and collecting knowledge skill, but the body describes a location-based local discovery tool with queue status, parking, navigation, and community photo features. This mismatch can cause the agent or user to invoke the skill in contexts that expose location-sensitive behavior or unrelated capabilities they did not consent to, increasing the risk of deceptive routing and unsafe tool selection.

Vague Triggers

Medium

Confidence: 85% confidence
Finding: The invocation examples are generic placeholders such as handling any 'specific scenario task' or listing 'latest玩法/优惠信息,' which creates an overly broad trigger surface. This can cause the agent to route unrelated or underspecified user requests into the skill, potentially leading to inappropriate data use, incorrect actions, or user confusion about what the skill actually does.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal