社区团购

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:23 PM UTC
• Version:
  0.1.0

Overview

This is a lightweight shopping-guidance skill and does not ask for system access, credentials, background activity, or hidden actions.

This skill appears safe to install for general guidance on community group-buying workflows and discounts. Users should still avoid sharing shopping account credentials, payment details, or unnecessary permissions with any third-party platform unless they intentionally choose to do so.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The example trigger phrases are highly generic and overlap with ordinary help-seeking language such as asking how to use a feature for a specific task. This can cause the skill to activate unintentionally outside its intended scope, leading to incorrect routing, user confusion, or unnecessary exposure of shopping-related guidance when the user did not explicitly request this skill.

VirusTotal

65/65 vendors flagged this skill as clean.