Random Password Generator Quantum

• Outcome: Pass
• Latest audit: Jun 10, 2026 at 2:49 AM UTC
• Version:
  1.0.0

Overview

This skill is a disclosed remote password-generation wrapper, with no local executable code or hidden persistence, though its discovery keywords are broader than ideal.

Install only if you are comfortable using AgentPMT as the remote service that generates and returns passwords. Because these are credentials, confirm the agent invokes it only for explicit password-generation tasks and avoid using generated passwords where policy requires locally generated secrets only.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The activation keywords include very generic terms such as 'generate', 'length', and 'uppercase', which can cause this skill to be selected for unrelated user requests. Because this skill triggers remote tool usage and may generate or transmit sensitive credentials, overly broad routing increases the chance of unintended external calls and password handling in the wrong context.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The manifest description embeds ambiguous discovery phrases including broad security-related terms like 'generate', 'length', 'uppercase', 'encryption keys', and 'initial user onboarding'. In an agent ecosystem, this can over-match ordinary requests and invoke a remote credential-generation tool when the user did not explicitly ask for it, increasing the risk of inappropriate secret creation or external transmission.

VirusTotal

64/64 vendors flagged this skill as clean.