pinyin-box

Security checks across malware telemetry and agentic risk

Overview

This skill appears to be a straightforward worksheet generator, with normal cautions around OCR, saved output files, and an external package install.

Install in a virtual environment when possible, since the skill depends on an external pinyin-box package. Use it only with text or images you intend to turn into practice sheets, and avoid sensitive images unless you are comfortable with OCR text and generated files being saved in the workspace output directory.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger description is very broad, including phrases like converting 'any content' into practice sheets, which can overlap with ordinary user requests and cause unintended invocation. Over-broad activation can route unrelated content, including sensitive text or images, into OCR and file-generation flows without sufficiently explicit user intent.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill performs OCR on user-provided images and writes generated files to a workspace path, but the documentation does not clearly tell users that image contents will be extracted and persisted to disk. This creates a privacy and data-handling risk because users may submit screenshots or documents containing sensitive information that gets stored locally without explicit notice or confirmation.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal