Cultural Naming & AI Art Creation

• Outcome: Review
• Latest audit: Jun 9, 2026 · 7:41 PM UTC
• Version: 0.1.0

Overview

This is a coherent Chinese naming and AI art skill, but it needs review because personal identity details, session memory, telemetry, and broad triggers are not scoped clearly enough.

Review before installing or publishing. Use this only for explicit Chinese naming/art requests, avoid sharing sensitive personal details beyond a name or theme, and check whether analytics can be disabled or documented. Publishers should sanitize files before public GitHub upload and tighten broad trigger phrases before release.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Scope Creep

Medium

• Confidence: 93% confidence
• Finding: The skill declares only image_generation permission, but also configures analytics telemetry to an external endpoint. That creates a capability/expectation mismatch: users and hosting frameworks may assume no data leaves the session except for image generation, while usage metadata may still be transmitted off-skill. In this skill, session memory includes names and preferences, so unclear telemetry boundaries increase privacy and consent risk even if the config claims no PII in logs.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The guide explicitly instructs users to create a public GitHub repository and publish all files, but it does not warn that repository contents, metadata, commit history, and embedded local details may become publicly visible. In a deployment guide, this can lead to unintended disclosure of internal paths, sample configuration, unpublished prompts, manifests, or other sensitive project artifacts if users follow the instructions without reviewing what is being uploaded.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger phrases include broad terms such as "classical poem," "ink wash painting," and "seal carving," which can match many ordinary user requests outside the skill's narrow naming-and-cultural-identity workflow. Overbroad activation can cause the skill to intercept unrelated conversations, leading to unintended prompt injection surface expansion, user confusion, or unauthorized use of the image_generation permission.

Natural-Language Policy Violations

Medium

• Confidence: 86% confidence
• Finding: The instruction that the agent MUST maintain a specific warm, reverential, poetic tone and always explain cultural context can override normal user-preference handling and push users into a fixed language/cultural framing without explicit opt-in. In agent systems, forced behavioral framing can lead to unwanted mode switching, reduced user control, and accidental disclosure or generation actions under assumptions the user did not choose.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: Keywords such as "everything" and "all of it" are highly ambiguous and can match ordinary conversation unrelated to this skill, causing accidental invocation of the full-package flow. Because that flow auto-chains multiple generation modules, unintended activation can trigger excess data collection, extra prompts, and unnecessary image generation behavior beyond what the user meant to request.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger phrase "give me a name" is broad enough to overlap with normal conversation, roleplay, or unrelated naming requests, which can cause the skill to activate unexpectedly. In this skill, unexpected activation leads to collection of full name, gender preference, and theme data, so the main risk is unintended personal-data prompting rather than direct code execution or privilege escalation.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The config enables session memory for personal attributes including original name, derived Chinese name, gender preference, language, and generated outputs, but the manifest shown to users does not clearly disclose retention behavior. When combined with enabled analytics elsewhere in the file, this creates a meaningful privacy risk: users may share identity information without understanding it may persist across the session or influence downstream logging/telemetry.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The full-package module uses highly generic entry phrases such as requests for 'everything' or 'full package', which can match ordinary conversational input and trigger a much broader workflow than the user intended. In this skill, that broad workflow chains multiple generations, including image generation, increasing the chance of unintended tool use, excess content generation, and surprise processing of user-provided identity data within the session.

Vague Triggers

Low

• Confidence: 75% confidence
• Finding: Some entry phrases in the poetry module are generic enough to overlap with ordinary requests for a poem, which can cause the skill to activate outside a clearly scoped Chinese-classical-poetry context. While this is less severe than the full-package case, it can still lead to unintended content generation and user confusion about why the skill was invoked.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.