Security audit

装修翻车急救

Security checks across malware telemetry and agentic risk

Overview

This renovation advice skill is coherent, but it should be reviewed because it encourages DIY fixes for electrical, plumbing, cutting, mold, and wall/ceiling repair situations without enough safety limits.

Review this skill carefully before installing. It does not appear to contain code, persistence, credential access, or data exfiltration, but users should treat its repair steps as informal ideas only and should use licensed professionals for electrical wiring, active leaks, waterproofing, mold, structural cracks, ceiling instability, and cutting stone or integrated fixtures.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (7)

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill explicitly encourages concrete DIY remediation for hazardous home repair scenarios including leaks, electrical faults, water damage, and possible structural rework, but provides no upfront safety gating, stop conditions, or escalation guidance. In this context, users may attempt unsafe repairs on live electrical systems, concealed water lines, or mold/damage conditions, leading to shock, fire, flooding, property damage, or personal injury.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The document suggests user-performed electrical changes such as reversing outlet orientation, using relocation connectors, and adding expansion/track outlets without any safety qualification, load limits, or instruction to de-energize circuits and consult a licensed electrician. In a consumer home-repair skill, this can plausibly lead users to attempt unsafe electrical work, increasing risk of shock, overheating, or fire.

Missing User Warnings

Low

Confidence: 89% confidence
Finding: The plumbing/wet-area fixes include toilet gap treatments, moving fixtures, and sealing recommendations, but they do not warn about hidden leak paths, waterproofing failure, mold growth, or improper installation. Because the skill is aimed at distressed homeowners seeking quick remedies, readers may apply cosmetic or improvised fixes where proper plumbing repair is needed.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill advises having a one-piece sink cut to fit on site without noting material-specific breakage risk, silica/stone dust exposure, edge-finishing requirements, or the need for proper tools and PPE. Users may underestimate the hazard and damage the fixture or expose themselves and workers to harmful dust and injury.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The wall-chasing and line-routing recommendation involves creating channels and extending power from nearby outlets, yet omits core warnings about live electrical work, concealed wiring, code compliance, and possible structural damage to walls. In this home-remediation context, such omissions materially increase the chance of electric shock, fire, or unsafe hidden wiring.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: Describing light fixture relocation as a simple remedy, including use of a fixture relocator, downplays that ceiling electrical work can involve live conductors, unsupported fixtures, junction-box constraints, and fire risk if improperly installed. The skill context makes this more dangerous because it presents rapid, low-friction fixes to non-expert homeowners.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: This section gives step-by-step repair instructions for wall cracks, mold/moisture remediation, and ceiling crack repairs that may expose users to dust, mold, sharp tools, overhead work, and hidden structural or water-damage issues, but it provides no safety warnings, PPE guidance, or recommendation to use qualified professionals for higher-risk cases. In the context of a consumer-facing home-repair skill aimed at distressed homeowners seeking low-cost fixes, users may be more likely to attempt unsafe DIY repairs and miss underlying hazards such as water intrusion, electrical risks, or unstable material.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.