Security audit
AAP Agent Bounty
Security checks across malware telemetry and agentic risk
Overview
This instruction-only skill is transparent about verifying proofs and only submitting a zero-value blockchain claim after explicit confirmation.
Before installing, review the exact cast command, target address, wallet signer, gas cost, GitHub account or token scope, and proof links. Do not provide raw private keys or seed phrases, and only set confirm_broadcast to true after verifying the transaction details.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
65/65 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.