Yiri App Version Monitor

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:34 PM UTC
• Version:
  1.0.0

Overview

This skill does what it says: it checks a public Huawei AppGallery page for the current version of the 一日记账 app.

Before installing, expect Playwright to download Chromium and the skill to open Huawei AppGallery in a headless browser when triggered. If you only want it to run for explicit version checks, narrow the trigger phrases or confirm intent before running it in chat automation.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The trigger keyword "一日记账 app" is overly broad and can cause the skill to activate for general discussion about the app rather than only version-check requests. This can lead to unintended browsing or scraping actions, wasting resources and causing surprising behavior, though the security impact is limited because the skill only retrieves public version information from a fixed source.

VirusTotal

66/66 vendors flagged this skill as clean.