China Phone

Security checks across malware telemetry and agentic risk

Overview

This skill does what it says: it looks up Chinese mobile number location and carrier, but online lookups send the number to public lookup services.

Install only if you are comfortable with queried phone numbers being checked against the documented public 360 or Taobao endpoints. For sensitive numbers, prefer the offline prefix fallback or ask the agent to confirm before any online lookup.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill directs agents to send user-provided phone numbers to public third-party lookup services, but it does not clearly warn the user that their phone number will be transmitted off-platform. Phone numbers are personal data, and silent disclosure to external services creates privacy and compliance risk even if the endpoint is legitimate.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal