Matrix Mentions Patch

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:32 PM UTC
• Version:
  1.1.1

Overview

This is a narrow, instruction-only skill for manually patching a Matrix mention bug, with no executable payload or hidden automation.

Use this only if you intend to manually patch your local Matrix extension. Before applying it, verify the target file and actual agent ID, note or back up the original line for rollback, and restart the gateway only when a short interruption is acceptable.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill instructs the operator to directly modify a live source file under a local installation path and restart the gateway, but it provides no warning about service disruption, rollback, backup, or validation steps. Even if the patch goal is legitimate, these actions can break the running system, introduce configuration-specific errors, or cause downtime if applied incorrectly.

VirusTotal

65/65 vendors flagged this skill as clean.