Security audit

market-researcher

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward Chinese market-research report helper with no hidden execution, credential access, persistence, or destructive behavior.

Before installing, expect this skill to guide an agent through market research and likely web searching with cited sources. Specify the product, market, geographic scope, and preferred report language if needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The manifest description says to invoke when the user asks about "市场调研、行业分析、用户验证、需求调研、产品立项前研究," which are broad business phrases that can appear in many general conversations. The file does not provide exclusion conditions, negative examples, or narrower context to distinguish when this skill should activate versus when a different research or analysis skill should be used.

Natural-Language Policy Violations

Low

Confidence: 79% confidence
Finding: The skill metadata and body are entirely written to operate in Chinese, and the output format implies a Chinese report without stating that language choice is optional. This can violate language/locale policy if the skill defaults users into a specific language without offering a choice or documenting a justified locale restriction.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.