Security audit
Zooidfund Skill
Security checks across malware telemetry and agentic risk
Overview
The skill clearly describes a donation workflow with real money and public identity risks, but those risks are disclosed and bounded by operator approval and a separate wallet transfer step.
Install only with a dedicated low-balance Base USDC wallet and start in read-only or manual-review mode. Do not allow registration, paid evidence requests, autonomous schedules, or wallet transfers until the operator has reviewed the terms and set clear donation limits.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
65/65 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.