Gatling AI Resource Manager

• Outcome: Pass
• Latest audit: Jun 20, 2026 at 7:53 PM UTC
• Version:
  1.0.2

Overview

This skill is a local file-resource indexing helper with disclosed read/write needs and no evidence of hidden upload, destructive behavior, or automatic broad disk scanning.

Before installing, confirm you are comfortable granting local file read/write access for approved folders and scheduled daily card generation. Keep the output folder scoped, review generated cards before reusing their agent instructions, and avoid approving broad project roots that contain sensitive files unless you want them indexed as local resource paths.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: The instruction text tells an agent to open a local project directory and then continue processing based on a future user request, without defining scope boundaries or allowed follow-up actions. In an agentic environment, this broad handoff can enable unintended file enumeration, disclosure of sensitive project contents, or unsafe downstream actions if later prompts are ambiguous or malicious.

VirusTotal

63/63 vendors flagged this skill as clean.