Analyze Open Source

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:25 PM UTC
• Version:
  1.0.0

Overview

This is an instruction-only code-analysis skill that reads a repository and produces a Chinese architecture report, with no evidence of credential use, persistence, file mutation, or data exfiltration.

Install this if you want repository analysis reports in Chinese. Because the skill asks the agent to read project files, use it only on codebases you are comfortable having analyzed, and avoid pointing it at private repositories containing secrets unless that is intentional.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The skill unconditionally requires all analysis output to be in Chinese, overriding user preference and reducing transparency for users or reviewers who do not read zh-CN. In a code-analysis skill, this can hinder oversight, validation, and safe use of the generated report, especially in mixed-language or enterprise environments where English is expected.

VirusTotal

62/62 vendors flagged this skill as clean.