Nm Pensive Rust Review

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:39 PM UTC
• Version:
  1.0.2

Overview

This is a Rust code review helper with no evidence of hidden, destructive, credential-seeking, or persistent behavior.

Installers should expect a Rust-focused review assistant. Consider narrowing triggers if you only want it to run on explicit Rust audit requests, and review any Cargo audit commands before allowing them to run in a project.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger list includes broad single-word activators such as "rust," "unsafe," "traits," and "cargo," which are likely to match ordinary discussion rather than an explicit request to invoke this skill. In an agent environment, overly broad activation can cause unintended skill execution, leading to confusing behavior, unnecessary command suggestions, or inappropriate review workflows being injected into unrelated conversations.

VirusTotal

64/64 vendors flagged this skill as clean.