雄韬书法AI应用 - 汉字重心

• Outcome: Pass
• Latest audit: Jun 15, 2026 at 12:56 PM UTC
• Version:
  1.0.1

Overview

This skill is a local Chinese-character visual-balance analyzer that creates reports and optional PNG images without evidence of hidden network access, credential use, or destructive behavior.

Install this if you want a local Hanzi visual-center analysis helper. Be aware it requires npm dependencies including the native canvas package, and by default it saves PNG files in the working directory; use --no-png or run it in a scratch workspace if you do not want generated images retained.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 72% confidence
• Finding: The trigger description is broad enough to match many ordinary questions about Chinese characters, balance, or calligraphy, which can cause the skill to activate outside narrowly intended scenarios. Over-broad routing is dangerous because it increases unintended tool invocation, unnecessary code execution, and exposure to prompt/command injection opportunities through user-controlled inputs passed to the underlying script.

VirusTotal

64/64 vendors flagged this skill as clean.