Technical Documentation Engine

Security checks across malware telemetry and agentic risk

Overview

This is an instruction-only technical documentation skill whose project review and document generation behavior matches its stated purpose.

Safe to install for documentation work. Use it only on projects you intend the agent to inspect, give explicit target files or directories for audits and generated docs, and review any generated documentation or CI/pipeline changes before committing them.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The quick-start phrase "Audit the docs for my project" is generic enough that it could plausibly appear in normal user conversation, causing the skill to activate unintentionally. In an agent environment, broad activation phrases can hijack unrelated interactions and steer the agent into this skill's workflow without explicit user intent, which is a prompt-routing and control issue even if the skill itself is non-exploitative.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The skill exposes very broad natural-language triggers such as 'Write a README', 'Review this doc', and 'Set up docs pipeline' without scoping constraints, confirmation steps, or repository/path boundaries. In an agent environment, this can cause overbroad activation on common requests and lead to unintended file generation, modification, or analysis across a project, especially when paired with automation-oriented actions.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal