家庭厨师

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:18 PM UTC
• Version:
  3.0.0

Overview

This is a meal-planning skill with disclosed local profile storage and recipe/price web search use, with no executable code or hidden high-impact behavior found.

Install only if you are comfortable with a plaintext local cooking profile. Recipe and price searches may send city, ingredient, or dish names to a web search provider, despite the privacy wording that says the skill does not connect to external servers.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The skill's trigger description is broad enough to match many ordinary cooking-related requests, which can cause unintended activation and unnecessary access to user context or local profile data. While this does not directly enable code execution or exfiltration, it increases the chance of overreach and misrouting of user requests to the skill when a more general assistant response would be safer.

VirusTotal

66/66 vendors flagged this skill as clean.