Yyh211 Daily Ai News

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:20 PM UTC
• Version:
  1.0.0

Overview

The skill appears to be an AI-news briefing helper with no evidence of hidden, destructive, credential-stealing, or persistent behavior.

Install only if you want the agent to browse for current AI news. For conceptual AI questions or non-news discussion, explicitly tell the agent not to use the news workflow.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The skill description activates on broad phrases like 'AI updates' and 'latest AI developments', which can match ordinary conversation rather than an explicit request for a news-aggregation workflow. This can cause unintended tool use, surprising behavior, and unnecessary web access when the user may only want general discussion or analysis.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The 'When to Use This Skill' section includes ambiguous triggers such as 'wanting to know what's happening in AI' and 'AI industry news, trends, or breakthroughs', which lack clear scope boundaries. In context, this increases the chance of the skill hijacking normal AI-related conversation and launching multi-step browsing and summarization without sufficiently specific user intent.

VirusTotal

66/66 vendors flagged this skill as clean.