celebration firework

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:21 PM UTC
• Version:
  1.0.2

Overview

This skill is a disclosed firework-celebration link generator; the main caution is that confirmed content is sent to an external service and becomes a shareable page.

Install only if you are comfortable using an external service to generate hosted celebration links. Prefer generic wording, review the exact preview before confirming, and avoid names, confidential project details, or sensitive personal messages in any celebration page you may share.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The examples show the agent directly creating and sharing celebration links without consistently demonstrating the documented confirmation and privacy-consent flow. In practice, this can normalize generating shareable pages containing personalized names, relationships, or milestone details without explicit user approval, causing unintended disclosure of personal information via publicly accessible links.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The skill treats broad emotional or achievement-like phrases such as 'finally finished' or 'got it done' as trigger signals, which can cause unsolicited activation without a clear user request for this external-sharing feature. Because the skill generates outbound celebration links via a third-party service, accidental triggering can lead to unwanted data transmission, manipulative upsell behavior, or user surprise even if only generic content is intended.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The 'dual-trigger' design explicitly allows agent-initiated prompting after task completion but does not define strict boundaries for when promotion is appropriate or how often it may occur. In a skill that creates externally hosted links, this increases the risk of overbroad activation, dark-pattern style nudging, and actions that feel user-authorized when they were primarily agent-driven.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The skill recommends proactively offering a celebratory firework show whenever a user mentions a special date, which is a broad trigger that can cause unsolicited suggestions and unnecessary transmission of user-context-derived content to a third-party service. While the skill includes later consent guidance, this trigger design still increases the chance of nudging users into external sharing in situations where they did not request it.

VirusTotal

66/66 vendors flagged this skill as clean.