Community Quick Scan

• Outcome: Pass
• Latest audit: Jun 5, 2026 at 11:33 AM UTC
• Version:
  0.1.0

Overview

This is a small community-audit prompt with no executable code, but users should be careful about sharing private Discord or Telegram invite links.

Install is reasonable for a quick community-review workflow. Only provide public, reusable, or intentionally shared invite links; use screenshots, redacted onboarding text, or manually supplied metrics for private communities. Do not share admin credentials, bot tokens, or private moderation data.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill asks users to provide a community invite link without any privacy notice, access-scope explanation, or guidance about whether the link may expose private or semi-private spaces. This can lead users to disclose sensitive invite URLs or grant unintended access to communities, increasing privacy and unauthorized-access risk.

VirusTotal

63/63 vendors flagged this skill as clean.