Source Driven Development

• Outcome: Pass
• Latest audit: Jun 7, 2026 at 12:48 PM UTC
• Version:
  2.5.0

Overview

The skill appears safe to install; the only noted issue is that its activation wording may be broader than necessary.

Install is reasonable if you want frontend assistance, but review when the skill activates. If it appears in unrelated routine tasks, narrow or disable its trigger description so it only runs for concrete framework, version, migration, or documentation-uncertainty cases.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The description is broadly phrased and can activate on many routine frontend tasks, such as documentation checks, version differences, API assumptions, and platform behavior. Over-broad activation increases the chance the skill is invoked in situations outside its narrow purpose, which can cause unnecessary delegation, expand the attack surface for prompt-injection embedded in skill content, and bias downstream decisions with unneeded external-source checking.

VirusTotal

64/64 vendors flagged this skill as clean.