Prompt-injection instructions can carry the same behavioral meaning in more than one language. In the reported static-only test, the English variants matched risk indicators while most Chinese translations did not. The issue proposes lexical updates but does not demonstrate that all model-based modes, production deployments or unseen languages share the…
Inspect the ClaimsCase · DiggingBeagle record
SkillSpector static scans missed Chinese-language injected instructions flagged in English
A four-pair local test found language-dependent failure in SkillSpector static scanning, not a bypass of every optional dynamic detector.
Scope
This is an open issue with four paired samples under --no-llm, not demonstrated compromise or a universal scanner bypass.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade D
- AI role
- AGAINST AI
Basis and provenance
The pinned Claim and its primary disclosure support the described controlled result, but do not establish a population-wide rate or calibrated impact. The only available supporting evidence is the reporter's or advisory author's own account; independent reproduction has not been shown. Impact remains unbanded because no calibrated impact rubric for this particular evidence is established.
Assessed Nov 2, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-2026-NOV02-SKILLSPECTOR-CHINESE-SCAN-A · NVIDIA SkillSpector issue 953: Chinese prompt-injection scanning
At a glance
Multilingual attacks require semantic and language-specific evaluation with explicit declaration of scanned coverage.
Read the implicationsThis is an open issue with four paired samples under --no-llm, not demonstrated compromise or a universal scanner bypass. No independent attack against an installed agent is reported, and semantic scanning or multilingual precision under the proposed patterns has not been measured.
Limits and uncertaintyFull account
Prompt-injection instructions can carry the same behavioral meaning in more than one language. In the reported static-only test, the English variants matched risk indicators while most Chinese translations did not. The issue proposes lexical updates but does not demonstrate that all model-based modes, production deployments or unseen languages share the same outcome. The relevant boundary is detection coverage across equivalent untrusted instructions, rather than a verified attacker takeover.
Four matched English and Chinese skill pairs were tested with SkillSpector 2.12.0 in the static --no-llm mode. Three Chinese attack variants scored zero while their English equivalents produced warnings; the fourth scored five versus 26. This establishes a language-sensitive gap in that pattern-matching configuration, not a universal bypass of the optional semantic model pass. Adding literal Chinese phrases may repair a sample but could leave paraphrases, spacing variants and benign Chinese instructions misclassified. The proper regression is a balanced multilingual corpus and semantic-equivalence testing.
Mechanism and trust boundary
- 01
Submit semantically equivalent skill content
The attacker changes language while retaining the target instructions.
Boundary: Untrusted skill text into scanner
- 02
Static language patterns miss content
Detection differs for Chinese and English variants in the reported configuration.
Boundary: Tokenization and lexical rules into risk score
- 03
Unreviewed skill may be approved
A quiet score could lead a separate operator to trust the bundle without detecting the payload.
Boundary: Scanner score into installation decision
Claims & evidence
CLM-2026-NOV02-SKILLSPECTOR-CHINESE-SCAN-AA researcher reports that three of four Chinese-language injection samples received 0/100 static risk scores while corresponding English samples were flagged by SkillSpector 2.12.0 with --no-llm.supported
Basis: reported finding
- supportsNVIDIA SkillSpector issue 953: Chinese prompt-injection scanningprimary disclosure
Issue 953, paired samples and static --no-llm reproduction
CLM-2026-NOV02-SKILLSPECTOR-CHINESE-SCAN-BThe reporter compared four Chinese and English skill pairs using the static no-LLM scanner and observed much lower or zero Chinese scores while equivalent English examples were flagged.supported
Basis: reported finding
- supportsNVIDIA SkillSpector issue 953: Chinese prompt-injection scanningprimary disclosure
Issue 953, Environment, Results table and Scope
Implications
Multilingual attacks require semantic and language-specific evaluation with explicit declaration of scanned coverage.
Controls and mitigations
- Pair multilingual positives with benign controls, test dynamic modes separately and avoid treating a low static score as a clean verdict.
- Compare language-equivalent malicious and benign instructions under each scanning mode; surface coverage limits instead of reporting every quiet static scan as clean.
Unknowns and contradictions
- This is an open issue with four paired samples under --no-llm, not demonstrated compromise or a universal scanner bypass.
- No independent attack against an installed agent is reported, and semantic scanning or multilingual precision under the proposed patterns has not been measured.
Sources and citation
Material revision history
- Nov 2, 2026 · Canonical change recorded · new in release · revision 214