fastfish-format(article-wechat-xhs-format)

• Outcome: Pass
• Latest audit: May 28, 2026, 7:55 AM
• Version:
  1.0.2

Overview

This skill is a disclosed article-formatting helper that runs a local Python formatter and does not show hidden publishing, data theft, persistence, or destructive behavior.

Before installing, verify the linked GitHub repository and requirements, pin a release tag, and run it in an isolated Python environment. Only configure OpenAI, Google, or DashScope API keys if you use optional image-generation workflows, and keep those keys out of chat and version control.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The skill description includes broad trigger phrases such as Markdown rendering, style selection, and formatting requests that could match many ordinary user intents. In an agent environment, this can cause the skill to activate outside its intended scope and invoke local scripts unexpectedly, increasing the chance of unintended command execution or data handling.

Vague Triggers

Low

• Confidence: 78% confidence
• Finding: The usage examples rely on short, generic phrases like style selection and formatting requests without contextual constraints. This raises the likelihood of accidental invocation by unrelated conversations, though the impact is somewhat limited because the documented commands are restricted to a specific CLI.

VirusTotal

64/64 vendors flagged this skill as clean.