Nm Attune Project Execution

• Outcome: Pass
• Latest audit: Jun 7, 2026 at 9:44 PM UTC
• Version:
  1.0.3

Overview

This skill is a disclosed project-execution workflow that tracks implementation progress locally and does not show hidden, destructive, or exfiltration behavior.

Before installing, understand that this skill may create or update a local .attune/execution-state.json file and guide the agent to run normal project validation commands such as tests and linting. Consider adding the .attune state file to .gitignore if you do not want progress metadata committed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The skill explicitly instructs saving execution state to `.attune/execution-state.json` without warning the user that local project state will be modified. Silent writes can surprise users, interfere with repositories, leak project metadata into tracked files, or create persistence artifacts in sensitive workspaces.

VirusTotal

65/65 vendors flagged this skill as clean.