Pinduoduo

Security checks across malware telemetry and agentic risk

Overview

This is an instruction-only skill for summarizing public Pinduoduo product and event pages, with clear limits and no executable behavior.

Use this skill only for public Pinduoduo page summaries and comparisons. Do not provide credentials, private order details, or ask it to buy items, bypass platform controls, automate the app, or scrape at high volume.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The description says the skill should be invoked whenever access or automation related to Pinduoduo is needed, which is overly broad and can cause the agent to activate this skill in situations beyond its stated safe scope. That increases the chance of unintended browsing or automation against a commercial platform, including contexts involving restricted scraping or transactional actions that the body later says should not be performed.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal