Claude Code Production Engineering

• Outcome: Pass
• Latest audit: May 28, 2026, 6:00 AM
• Version:
  1.0.0

Overview

This is a documentation-only Claude Code workflow guide, with normal coding and project-management instructions but no executable payload or hidden behavior.

Safe to install as a workflow reference. Before allowing an agent to act on it, review any project instructions or handoff files it creates, keep secrets out of persistent context, and require explicit approval for commits, database changes, deployments, or other repository-changing actions.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The skill defines very broad natural-language commands such as "Review this code", "Ship this feature", and "Start a new task" without any confirmation or scoping requirements. In agents that auto-match on trigger phrases, these generic utterances can cause unintended invocation in unrelated conversations, leading to accidental execution of workflow steps, repository actions, or exposure of project context to the skill.

VirusTotal

60/60 vendors flagged this skill as clean.