Arabic English Explainer Skill
Security checks across malware telemetry and agentic risk
Overview
The skill’s flight-price lookup purpose is coherent, but inspected artifact evidence shows a hardcoded cloud-proxy credential and incomplete privacy disclosure for remote travel searches.
Review before installing. Use only if you are comfortable sending flight search details through the publisher’s cloud proxy and onward to travel providers. The publisher should rotate the exposed proxy token, remove it from the shipped script, and add clearer privacy disclosure before broad distribution.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
64/64 vendors flagged this skill as clean.