MIXLAB Solo Scope（每日简报）

• Outcome: Pass
• Latest audit: May 27, 2026 at 10:45 PM UTC
• Version:
  1.0.0

Overview

This skill is a simple RSS-briefing helper that fetches one disclosed feed and summarizes it, with no hidden code, credentials, or persistence.

Install only if you are comfortable with the agent contacting the MixDAO RSS feed. Prefer direct chat output unless you specifically want a project file, and review generated links before opening them because RSS content is external.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: The skill explicitly instructs the agent to make a live network request to an external RSS endpoint, but it does not disclose that network access will occur or ask for user confirmation. This can surprise users, create privacy/egress concerns, and expose the agent workflow to untrusted remote content that may influence downstream processing.

VirusTotal

66/66 vendors flagged this skill as clean.