Qms Audit Expert

• Outcome: Pass
• Latest audit: May 28, 2026, 8:05 AM
• Version:
  2.1.1

Overview

This is a coherent ISO 13485 audit guidance skill with a local scheduling helper and no evidence of hidden access, exfiltration, persistence, or destructive behavior.

Use this skill for ISO 13485 medical-device QMS audit work, and verify its outputs against your regulatory and certification requirements. Because some triggers are generic, confirm it is being applied only to the intended medical-device QMS context and provide only the QMS records needed for the task.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence
• Finding: This is a mismatch because the description presents a broad internal-audit expertise skill, including audit execution, finding/nonconformity classification, CAPA verification, audit checklist support, and external audit preparation, but the code only performs audit schedule optimization/planning. There is no functionality for conducting audits, classifying findings, verifying CAPA effectiveness, preparing external-audit materials, or managing checklists. The triggers also include terms like 'nonconformity classification', 'CAPA verification', 'audit finding', and 'external audit prep', which would activate the skill in contexts the code does not support. There is no evidence of hidden or unrelated behavior; the mismatch is that the implementation is substantially narrower than the declared purpose.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger list includes generic phrases such as "internal audit," "audit planning," "audit checklist," and "audit finding" without narrowing context or exclusion conditions. Because the file does not specify when these triggers should or should not activate, ordinary conversations about audits could match unintentionally.

VirusTotal

54/54 vendors flagged this skill as clean.