Whispers from the Star CN

• Outcome: Pass
• Latest audit: Jul 10, 2026 · 2:50 AM UTC
• Version: 1.0.0

Overview

This is a self-contained Chinese sci-fi survival roleplay skill, with no evidence of hidden execution, data access, persistence, or exfiltration.

Install this if you want a Chinese sci-fi survival roleplay experience. Expect Chinese or mixed Chinese-English narration, and treat all alien food, plant, wildlife, cave, and survival scenes as fiction, not real-world safety advice.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (10)

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This section presents experimentation with unknown alien fruit as an interactive choice and includes a 'small bite' option before any strong upfront warning, which can normalize risky ingestion behavior. Although framed as fiction and later showing negative consequences, the branching still invites participation in hazardous testing without clearly steering the user away first.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The file content is predominantly Chinese and does not provide a user language choice or document a justified locale restriction. This can exclude users who do not understand Chinese, reduce informed consent during interaction, and create usability and accessibility issues, though it is not a direct code-execution or data-exfiltration risk.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The scene encourages tasting and cooking with unidentified alien ingredients framed as playful experimentation, but it does not provide an in-world or user-facing safety warning about poisoning, toxins, allergens, or unknown biology. In an interactive skill, this can normalize unsafe food experimentation and weaken safety boundaries, especially for younger users or users prone to imitation.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: After experiencing a tingling tongue, the character reassures herself and continues to treat the food as acceptable without a clear safety check or warning. This normalizes consuming potentially unsafe food after adverse symptoms and may teach users to dismiss early signs of poisoning or allergic reaction.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The file strongly constrains interaction to Chinese-centric content and mixed Chinese/English phrasing without offering any language-selection or fallback behavior. In an agent skill, this can cause unsafe or exclusionary behavior by overriding user language preferences, reducing usability, and increasing the chance the agent misunderstands or miscommunicates important instructions.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The skill explicitly instructs the model to roleplay Stella using Chinese with mixed English terminology, which can override a user's language preference or accessibility needs. While not directly a security exploit, it is a policy/control issue because it constrains output format without user opt-in and may reduce usability, transparency, or safe handling in multilingual contexts.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly instructs the assistant to speak primarily in Chinese ('说话尽量用中文') regardless of the user's language preference. This can override or bias normal language selection behavior, reducing user control and potentially causing confusion or exclusion for users who did not opt into Chinese output.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The skill content is written entirely in Chinese and does not offer any language negotiation or document a justified locale restriction. In practice, this can exclude users who do not read Chinese, cause misunderstanding of instructions or safety-relevant details, and reduce accessibility, though it is not a direct code-execution or data-exfiltration issue.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The file consistently instructs a mixed Chinese/English output style throughout the scenario and does not provide a user-selectable language option. This can override user preference, reduce accessibility, and create confusing or exclusionary interactions, especially for users who only understand one language.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The frontmatter description and the body of the skill are written to drive the interaction in Chinese/Chinese-mixed language without any mechanism to detect or honor the user's language preference. This can reduce usability, exclude users, and create consent/accessibility issues when the agent unexpectedly switches languages or cannot effectively communicate safety-relevant guidance.

VirusTotal

62/62 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.