Security audit

老子AI Laozi AI

Security checks across malware telemetry and agentic risk

Overview

This is a Laozi/Tao Te Ching reference skill that uses a local JSON dataset and does not request dangerous access or hidden behavior.

Install this if you want Laozi/Tao Te Ching lookup and multilingual quotation support. Be aware that it may activate for broad Taoism-related prompts and may return Traditional Chinese, Simplified Chinese, and English unless the user asks for a narrower format.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The skill trigger is broad enough to activate on many ordinary mentions of Laozi, Taoism, or related concepts, which can cause unintended routing and override a more appropriate general-purpose response. While this is not code execution or data exfiltration, it can degrade assistant behavior by invoking the skill when the user did not intend a structured Laozi lookup or philosophy workflow.

Natural-Language Policy Violations

Low

Confidence: 78% confidence
Finding: The documentation presents three-language output as the default behavior, which may cause the assistant to return more information than the user requested and reduce relevance or usability. In this skill's context, the risk is primarily prompt-quality and user-experience drift rather than a direct security compromise, but it can still lead to unnecessary disclosure of content or excessive output.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.