主题配色工厂

• Outcome: Pass
• Latest audit: May 28, 2026, 4:45 AM
• Version:
  1.0.0

Overview

This is a markdown-only design helper for choosing colors and fonts, with no code execution or sensitive access.

Install this if you want Chinese-language help choosing color palettes, fonts, and theme styling. Review suggestions before applying them to important documents, especially when your request is broadly phrased like “beautify this.”

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The skill description includes broad trigger phrases like '换个配色' and '美化这个文档', which can match many ordinary user requests and cause the skill to activate when the user did not explicitly ask for theme generation. In an agent environment, over-broad activation can hijack user intent, leading to inappropriate skill routing and undesired modifications to content presentation.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The '立即触发' section uses ambiguous activation rules such as '帮我美化一下' and '换个配色' without enough contextual constraints. This increases the chance of unintended invocation on generic requests, which can override the user's actual task flow or cause the agent to apply design transformations in the wrong context.

VirusTotal

No VirusTotal findings