Learning & Skill Acquisition Engine

Security checks across malware telemetry and agentic risk

Overview

This is a markdown-only learning coach skill with broad activation phrases but no hidden access, executable code, or unsafe behavior.

Reasonable to install as a learning-planning aid. Be aware it may activate on ordinary learning-related requests, and treat any goals, progress notes, motivation issues, or accountability details you share with the agent as personal information.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The quick-start triggers are extremely broad natural-language phrases such as 'I want to learn Python' and 'I'm stuck and losing motivation,' which are common benign user utterances that could unintentionally activate the skill. This increases the chance of prompt/skill hijacking, accidental invocation, or routing sensitive user context into the skill without explicit consent, especially in agents that auto-select skills from conversational text.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The skill defines very broad natural-language triggers such as 'I want to learn [skill]' and 'Review my learning progress' that can easily match ordinary conversation. In an agent environment, this can cause unintended invocation or route user messages into this skill when the user did not explicitly request it, creating prompt-routing confusion and increasing the chance of inappropriate context capture or action selection.

VirusTotal

60/60 vendors flagged this skill as clean.

View on VirusTotal