Shop Health Check

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:32 PM UTC
• Version:
  1.0.0

Overview

This skill is a disclosed shop-monitoring tool that checks configured store sites and can send reports to a user-configured Feishu webhook.

Install only for shops you are authorized to monitor. Treat the Feishu webhook as a secret, review config/shops.conf before enabling cron, and use the script's no-Feishu option or omit the webhook if report details should stay local.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 77% confidence
• Finding: The trigger phrases are broad enough to match ordinary requests such as '检查店铺健康度' or '巡检店铺', which could cause unintended activation of a skill that performs network scans and external notifications. In a monitoring skill with cron and alerting behavior, accidental activation increases the chance of surprise outbound traffic or noisy alerts.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The description explains the monitoring function but does not explicitly warn that the skill performs outbound requests to configured shop domains and may send operational findings to Feishu. This omission can mislead users about data flow, especially because alert content may include URLs, status information, and shop health metadata transmitted to third parties.

VirusTotal

66/66 vendors flagged this skill as clean.