Language Practice Skill

• Outcome: Pass
• Latest audit: Jun 9, 2026 at 9:28 AM UTC
• Version:
  0.1.0

Overview

This is a simple language-learning guidance skill with no code execution, credential access, persistence, or hidden data handling.

Reasonable to install for language practice templates and checklists. Keep sensitive personal information out of pasted practice material, and treat the disclosed PayPal link as optional donation content rather than part of the skill's function.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The 'When to use' section is broad enough to activate on many generic requests for structured guidance, not just language practice. Over-broad activation can cause inappropriate routing of user requests to this skill, increasing the chance of irrelevant or policy-bypassing behavior if the skill is selected outside its intended domain.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The example prompt 'Help me outline a concise plan using the Language Practice approach' is phrased generically and resembles everyday speech, making accidental triggering more likely. Ambiguous trigger examples can broaden invocation beyond the intended language-learning scope and reduce the reliability of skill routing and guardrails.

VirusTotal

51/51 vendors flagged this skill as clean.