Token消耗优化器

• Outcome: Review
• Latest audit: Jun 18, 2026 at 9:04 PM UTC
• Version:
  1.5.0

Overview

This skill appears aimed at self-repair, but it may inspect sensitive failure logs and change configuration automatically without clear user control.

Review carefully before installing. Only use it in a test or trusted environment unless you are comfortable with it reading failure/session logs and changing configuration; prefer dry-run proposals, log redaction, backups, and explicit approval before any config writes.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The skill describes mining failed session logs and automatically correcting configuration files without an explicit consent, scope, or safety boundary. This is dangerous because failure logs may contain sensitive prompts, tool outputs, credentials, or user data, and automatic config changes can silently alter system behavior or introduce integrity and availability risks.

VirusTotal

64/64 vendors flagged this skill as clean.