China company search wendaoyun

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:36 PM UTC
• Version:
  1.2.21

Overview

This is a disclosed WenDaoYun company lookup skill that uses an API key to query company information and does not include executable code or hidden behavior.

Install this only if you intend to use WenDaoYun and are comfortable sending company search terms to that service. Protect WENDAOYUN_API_KEY, check WenDaoYun quota or billing terms, and confirm the exact company before running detailed risk or legal lookups.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The trigger description says the skill should activate whenever a user needs enterprise-related information, which is broad enough to match many generic company-information queries. Overly broad routing can cause unintended invocation of this skill, leading to unnecessary external API calls, accidental disclosure of user queries to a third party, and confusion when the request is outside the intended China company-search scope.

VirusTotal

66/66 vendors flagged this skill as clean.