任务守望者与弹窗杀手 (Task Watchdog)

• Outcome: Pass
• Latest audit: May 28, 2026 at 9:01 AM UTC
• Version:
  0.1.0

Overview

The skill does what it says: watches long-running screen tasks, closes nuisance pop-ups, and can alert a user-configured webhook if the task appears to fail.

Install only if you are comfortable with an agent watching the screen and closing pop-ups during a long task. Configure webhook alerts only to an endpoint you control, and avoid leaving private documents, chats, credentials, or unrelated work visible while the watchdog is active.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill explicitly allows network access and instructs sending webhook alerts on fatal errors, potentially after taking a full-screen screenshot. Without clear disclosure, scoping, and data-minimization guidance, sensitive on-screen information, task details, or personal data could be transmitted to a remote endpoint unexpectedly. In this context, the continuous screen monitoring makes accidental leakage more likely, so the omission is materially risky.

VirusTotal

66/66 vendors flagged this skill as clean.