每日要闻

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:18 PM UTC
• Version:
  1.0.0

Overview

This is a normal daily-news skill that calls a disclosed news API, with only a minor risk of activating on broad news-related words.

Install if you are comfortable with a third-party news API being contacted when you ask for news. Consider narrowing the trigger wording or requiring explicit confirmation if accidental news lookups would be disruptive.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The trigger conditions are overly broad, including generic keywords like “新闻”, “日报”, and “头条”, which can match ordinary conversation and cause unintended activation of the skill. This is primarily a security-relevant safety issue because accidental invocation can lead to unsolicited external API requests and incorrect context handling, though it does not directly enable code execution or data exfiltration beyond the intended news query.

VirusTotal

46/46 vendors flagged this skill as clean.