Ship

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:16 PM UTC
• Version:
  1.0.0

Overview

This is a single-file shipping advice skill with broad activation wording but no code, credentials, persistence, or hidden data handling.

Safe to install as a logistics reference. Because shipping questions can involve customer addresses, tracking numbers, invoices, customs values, and business data, share only the minimum details needed and verify carrier rates, customs duties, restrictions, and claim deadlines with official carrier or government sources before acting.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger description is extremely broad and includes common phrases and generic logistics situations, which can cause the skill to activate in conversations where the user did not intend to invoke a shipping-specific workflow. Over-broad activation can lead to incorrect routing, irrelevant guidance, and increased exposure to downstream prompt or tool misuse if the skill is invoked in the wrong context.

VirusTotal

63/63 vendors flagged this skill as clean.