Security audit
RSS采集器 | RSS Fetcher
Security checks across malware telemetry and agentic risk
Overview
The skill mostly does what it claims, but its local HTML report can run unsafe browser code from RSS feed content, so it needs review before installation.
Install only if you are comfortable curating the feed list and treating fetched feed content as untrusted. Avoid opening generated HTML reports from feeds you do not trust, and prefer a version that escapes or sanitizes all feed-derived fields before embedding them in HTML or JavaScript.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
66/66 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.