Xiao Chuang You Objects

• Outcome: Pass
• Latest audit: May 28, 2026 at 1:32 PM UTC
• Version:
  2.2.1

Overview

This is a Chinese-language lifestyle advice skill for objects, incense, storage, and teaware, with no code execution or sensitive access.

Safe to install if you want Chinese-language guidance on incense, teaware, storage, and everyday objects. Be aware it may activate more often than intended because some trigger words are broad; narrowing those triggers would improve relevance.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The activation list includes very broad, high-frequency terms such as “香”, “购”, and “买”, which can cause the skill to trigger on unrelated user requests. This creates routing and prompt-selection risk: users may be pulled into this skill unexpectedly, leading to irrelevant guidance, reduced reliability, and increased exposure if downstream behavior is later expanded.

VirusTotal

64/64 vendors flagged this skill as clean.