Story Long Scan

• Outcome: Pass
• Latest audit: Jun 19, 2026 at 6:56 PM UTC
• Version:
  1.1.5

Overview

This skill is a disclosed web-novel ranking scraper and analyzer that writes local reports, with no evidence of hidden data theft, persistence, or destructive behavior.

Install only if you want automated scraping of ranking pages. Expect it to open public novel sites, possibly use a Chrome/CDP session for sites with anti-scraping behavior, and write Markdown reports to the chosen output directory. Avoid running modified commands or unusual parameters from untrusted sources.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The skill description lacks explicit activation boundaries and exclusion conditions, so it does not clearly distinguish between casual discussion of rankings and an instruction to run a multi-phase scraping workflow. In this context, ambiguous activation can cause unintended external requests, browser/CDP usage, and local file writes, expanding both privacy and operational risk.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The skill description lacks explicit activation boundaries and exclusion conditions, so it does not clearly distinguish between casual discussion of rankings and an instruction to run a multi-phase scraping workflow. In this context, ambiguous activation can cause unintended external requests, browser/CDP usage, and local file writes, expanding both privacy and operational risk.

VirusTotal

60/60 vendors flagged this skill as clean.