热点新闻

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:36 PM UTC
• Version:
  0.1.3

Overview

This skill is a disclosed trend/news lookup helper; its broad trigger wording and optional scheduler are worth noticing but do not show malicious behavior.

Install only if you want an agent to fetch live trending topics from public platforms. Be aware that generic words like "trend" or "热点" may activate it, and do not enable the scheduled briefing unless you intentionally want a persistent crontab entry.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The trigger phrase "热点" is extremely broad and can match many ordinary conversations unrelated to this skill. That increases the chance of accidental invocation, causing unexpected network access to an external service and potentially steering users into cron-setup prompts they did not intend to invoke.

VirusTotal

66/66 vendors flagged this skill as clean.