compliance-audit-pro

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:40 PM UTC
• Version:
  1.1.0

Overview

This is a text-only compliance review skill, but users should redact sensitive business and personal information before use.

Install appears reasonable for drafting compliance workpapers. Before using it, redact personal data, customer names, sensitive pricing, trade secrets, and regulated information where possible, and have qualified legal or compliance staff verify important citations, current-law status, and final decisions.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The README encourages users to submit contracts, bid documents, and internal policy text for analysis, which commonly contain confidential business terms, personal data, and procurement-sensitive information. Although it briefly suggests removing sensitive amounts and customer names, it does not clearly define data-handling expectations, retention, access, cross-border transfer, or whether full raw documents should be avoided, creating a meaningful privacy and confidentiality risk.

VirusTotal

65/65 vendors flagged this skill as clean.