Brand Strategy Engine

Security checks across malware telemetry and agentic risk

Overview

This is a markdown-only brand strategy guide; its broad activation examples are worth noting but do not create high-impact access or hidden behavior.

Safe to install as an instruction-only brand strategy skill. Use normal care with confidential business plans, customer data, or launch details you choose to share, and invoke it explicitly if your agent has many marketing-related skills installed.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The README suggests activating the skill with broad natural-language phrases such as "Build my brand identity" and "Plan my GTM" without defining clear routing boundaries. In an agent environment, generic phrases can cause unintended invocation during ordinary conversation, leading the skill to run when the user did not explicitly intend to use it and potentially influencing outputs or workflows unexpectedly.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The skill exposes a large set of generic natural-language command triggers such as "Plan my GTM," "Audit my brand," and "Score this content," which are broad enough to overlap with ordinary user requests. In an agent environment that auto-routes based on trigger phrases, this can cause unintended invocation of the skill, leading to prompt/domain hijacking, incorrect tool selection, or unreviewed handling of user inputs outside the user's intended workflow.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal