Dvc Pipeline Auditor

Security checks across malware telemetry and agentic risk

Overview

This is an instruction-only DVC audit skill whose project inspection is aligned with its stated purpose, with normal caution around DVC configuration details and suggested remediation commands.

Install this if you want an agent to review DVC pipeline structure and reproducibility. Point it only at projects you intend to inspect, avoid sharing credential files or real access keys, and review any suggested dvc push, pull, add, remote modify, repro, or gc command before running it.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The trigger list includes broad terms such as "ml pipeline," which can match many requests unrelated to DVC. Overly broad activation can cause the wrong skill to run, leading the agent to inspect files or produce DVC-specific guidance in inappropriate contexts, increasing the chance of incorrect actions or unintended data exposure during analysis.

VirusTotal

60/60 vendors flagged this skill as clean.

View on VirusTotal