Nm Attune Project Specification

• Outcome: Pass
• Latest audit: Jun 7, 2026 at 9:43 PM UTC
• Version:
  1.0.3

Overview

This is a documentation-only specification-writing workflow skill; its automatic handoff to planning is disclosed and limited, though users should stop it explicitly if they only want a standalone spec.

Install this if you want a spec-driven workflow that may continue from specification into planning. If you only want a one-off specification file, tell the agent to stop after the spec or use the documented standalone path before starting.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly instructs the agent to save a specification file and then automatically invoke the next workflow phase without an interactive confirmation step. In an agent setting, this creates an autonomy and unintended-action risk: the skill can cause chained execution and file modifications beyond the user's immediate request, especially if the user expected a single-step specification task.

VirusTotal

64/64 vendors flagged this skill as clean.