一键生成知乎高质量回答网页（可自由剪裁）

• Outcome: Review
• Latest audit: Jul 24, 2026 · 6:49 AM UTC
• Version: 0.1.0

Overview

This appears to be a real research-page generator, but it needs Review because it can infer private context, run extensive web/search workflows, alter local agent permissions, and persist task data without enough explicit user control.

Install only if you are comfortable with a long-running, network-heavy generator that may use recent conversation and workspace context. Prefer invoking it with an explicit topic, review any .claude/settings.local.json permission changes, and delete generated research logs or .workbuddy memory files if they contain sensitive context.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The skill description explicitly states the output will be generated in Chinese, which can override or constrain a user's language preference without clear opt-in. While not a code-execution issue, this creates a prompt-safety and user-consent problem because the agent may ignore the user's requested language or accessibility needs based solely on the skill metadata.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The trigger list includes broad, everyday phrases such as '怎么做', '入门指南', and '学习路径' that are not narrowly tied to this specific skill. In an agent environment, such generic triggers can cause accidental invocation for unrelated user requests, leading to unnecessary long-running searches, excessive token/tool consumption, and unintended generation of large web pages.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill requests extensive network access and repeatedly transmits user topic, context, and derived content to external web services and search providers, but the description does not clearly disclose this privacy impact. Because the workflow explicitly mines conversation/workspace context and sends it to search and avatar services, users may unknowingly expose sensitive project or personal information.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill requests extensive network access and repeatedly transmits user topic, context, and derived content to external web services and search providers, but the description does not clearly disclose this privacy impact. Because the workflow explicitly mines conversation/workspace context and sends it to search and avatar services, users may unknowingly expose sensitive project or personal information.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The prompt explicitly requires writing a report to a file path and treats completion as valid only if data is persisted to disk. This creates an unannounced side effect that can modify the local workspace, overwrite existing files, or be abused in environments where agents should not perform file writes without clear user consent and path constraints.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The invocation examples use vague trigger wording like '/zhihu-research-page 执行2%版本' without defining strict activation boundaries, allowed parameters, or confirmation requirements. In an agent setting, ambiguous triggers can cause unintended execution, misrouting, or abuse of a high-cost workflow that performs automated searching and large content generation.

Vague Triggers

High

• Confidence: 95% confidence
• Finding: The instruction to automatically infer a research topic from current conversation context and avoid asking the user is an overly broad auto-activation rule. This is dangerous because it can trigger the skill on unrelated or attacker-planted context, leading to unintended browsing, excessive resource use, privacy leakage from prior conversation content, or generation based on manipulated context.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The skill directs the agent to automatically mine prior conversation, workspace names, and CLAUDE.md project descriptions when the user does not explicitly provide a topic. That creates a real data-minimization and unintended disclosure risk because sensitive project details may be harvested and then used in downstream prompts or external searches without the user's informed approval.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: Tutorial mode instructs the agent to infer detailed user background such as coursework, programming ability, environment, and project stage from conversation context. This increases collection and reuse of potentially sensitive personal or project information beyond what is necessary for page generation, and may later be propagated into files or external tool prompts.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The search log format explicitly stores user background and learning-path diagnostic details in a persistent workspace file for downstream reuse. Persisting this information creates a retention risk and broadens exposure to anyone with later access to the workspace, especially when the data may include educational background, experience gaps, and project goals.

Ssd 3

Medium

• Confidence: 92% confidence
• Finding: The skill instructs the agent to append task completion records to a persistent memory file under the workspace. This creates unnecessary retention of user data beyond the immediate session and can accumulate sensitive task history, topics, or contextual details without a clear retention policy or opt-in.

External Transmission

Medium

• Category: Data Exfiltration

Content

| 优先级 | 来源 | 判定标准 |
|--------|------|----------|
| 1 级 | 真实人物公开头像 | 公开可独立验证的直链（GitHub CDN `avatars.githubusercontent.com/u/<id>`、豆瓣影人页、雪球/掘金/丁香园等平台公开头像、个人官网） |
| 2 级 | DiceBear 风格化 SVG | `https://api.dicebear.com/7.x/{bottts-neutral|avataaars|notionists}/svg?seed=<英文短语>&backgroundColor=<hex>&radius=50`，三种风格交替配合不同配色 |
| 3 级 | 单字符占位 | `<div class="zh-avatar" aria-hidden="true">{首字}</div>`（仅在前两级均不可用时使用） |

**铁律**：

• Confidence: 90% confidence
• Finding: https://api.dicebear.com/

External Transmission

Medium

• Category: Data Exfiltration

Content

curl -sI --max-time 5 "https://avatars.githubusercontent.com/u/1" | head -3

# 测 DiceBear API
curl -sI --max-time 5 "https://api.dicebear.com/7.x/bottts-neutral/svg?seed=test" | head -3

# 如有企业代理，补充 -x <代理地址>
curl -x http://proxy:port -sI --max-time 5 "https://avatars.githubusercontent.com/u/1" | head -3

• Confidence: 89% confidence
• Finding: https://api.dicebear.com/

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.