Sports Science Daily

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:14 PM UTC
• Version:
  1.0.0

Overview

This is a disclosed sports-science report skill that fetches public sources, translates them, and publishes to configured Feishu or Notion destinations.

Install only if you want this skill to send fetched public research/news content through Google Translate and publish the generated report to Feishu, and optionally Notion. Use limited-scope Feishu/Notion credentials, verify recipient IDs, and review the referenced external project code before running the Python command.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The skill description is broad enough that an orchestrator may invoke it for generic sports, fitness, or news-related requests without the user explicitly asking for this specific workflow. That can cause unintended external fetching, translation, and third-party syncing, which expands data exposure and action scope beyond user intent.

Natural-Language Policy Violations

Medium

• Confidence: 75% confidence
• Finding: Defaulting output to Chinese without explicit user opt-in can cause unintended transformation of content and may surprise users who expected source-language fidelity or another language. In a system that also posts to Feishu/Notion, this can propagate unwanted content changes to downstream platforms automatically.

VirusTotal

64/64 vendors flagged this skill as clean.