1coos-quickie

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed URL-to-Markdown clipping tool, with the main caution that it runs an external GitHub reader tool when used.

Install this only if you are comfortable with uvx running the external x-reader GitHub dependency for URLs you provide. Use explicit clipping commands, avoid sensitive URLs in stricter environments, and consider pinning or reviewing the external dependency if you need stronger supply-chain control.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The trigger/description is broad enough to activate on many ordinary URL-sharing, clipping, or note-taking requests, which can cause the skill to run in contexts the user did not explicitly intend. Because this skill performs network retrieval and executes tooling that fetches third-party code at runtime, over-triggering increases the chance of unintended external requests, content processing, and local file writes.

VirusTotal

67/67 vendors flagged this skill as clean.

View on VirusTotal