Security audit
vox
Security checks across malware telemetry and agentic risk
Overview
This skill is a narrowly scoped Vox CLI helper for transcribing one user-specified URL or local media file, with clear limits around files, credentials, installs, and output.
Before installing, confirm you trust the Vox service and npm package because transcribing a local file or URL may send media content to Vox and authentication uses a Vox API key. The skill itself includes clear safeguards to avoid broad file access, batches, hidden credential exposure, and unauthorized output overwrites.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
55/55 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.