Website Structure Analyzer

• Outcome: Pass
• Latest audit: May 29, 2026, 8:25 PM
• Version:
  1.0.0

Overview

This skill is a straightforward website-analysis helper that browses requested sites and saves reports locally, with no evidence of hidden code, credential use, exfiltration, or destructive behavior.

Install only if you want an agent to browse or extract content from target websites and save analysis files locally. Use public or approved sites, avoid private authenticated pages unless intended, and review saved reports or screenshots before sharing them.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger phrases are broad enough that the skill could activate on vague requests like '分析网站' or '结构', causing the agent to perform web data collection and report generation when the user may not have intended to invoke this specific capability. In this skill, unintended activation is more concerning because the workflow includes external site access and local artifact generation, which expands the side-effect surface beyond simple text processing.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly instructs saving reports and screenshots to local workspace paths without telling the user that files will be written. This creates a transparency and consent problem, and in practice can lead to unintended persistence of potentially sensitive browsing results, target URLs, or screenshots on disk.

VirusTotal

66/66 vendors flagged this skill as clean.