行业分析·成章官

• Outcome: Pass
• Latest audit: Jun 7, 2026 at 6:53 PM UTC
• Version:
  0.1.0

Overview

This is a scoped report-synthesis skill that reads expected local pipeline files and writes a local report, with no hidden code, credential use, network access, or install-time execution found.

Install if you want an agent to assemble the final industry-analysis report from this pipeline. Before rerunning it, confirm the intended output folder and keep a backup or review a diff if an existing industry-analysis-report.md matters.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The invocation guidance includes broad natural-language triggers like '整合 4 份 md', '重跑成章官', and '更新主稿', which can overlap with ordinary user editing or synthesis requests. In an agent environment, this can cause unintended skill activation on ambiguous prompts, leading to unauthorized file reads/writes within the output directory or unexpected workflow execution.

VirusTotal

63/63 vendors flagged this skill as clean.