Security audit

Taobao Live

Security checks across malware telemetry and agentic risk

Overview

This is a Taobao Live operations guide with no executable code or system access, but users should check its example sales scripts for platform compliance.

Safe to install as a reference skill, but treat its sales-script examples as drafts only. Before using generated copy publicly, remove absolute or unverifiable claims such as lowest-price promises and check it against current Taobao Live rules.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The example promotional script uses absolute and potentially unverifiable claims such as '全网最低没有之一', which directly conflicts with the same file's stated platform red lines prohibiting absolute language and false promotion. In a production assistant skill, this can cause the model to generate non-compliant sales copy that exposes merchants to platform penalties, account restrictions, and consumer-protection complaints.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: These example scripts normalize absolute promotional claims despite the file later documenting that such language violates Taobao Live rules. That contradiction makes the skill more dangerous in context because users are likely to copy the examples directly, causing policy violations, enforcement action, and misleading consumer communications.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.