Post Deployment Verifier

• Outcome: Review
• Latest audit: May 29, 2026 at 9:38 PM UTC
• Version:
  1.0.1

Overview

This skill appears intended for deployment checks, but it can inspect broad local logs and probe endpoints discovered from the environment without clear scoping or warning.

Review before installing. Use this only in environments where the agent is allowed to inspect local service logs and probe configured or discovered endpoints. Prefer an explicit .deploy-verify.json with known endpoints and avoid running the broad Docker/systemd log checks on shared hosts or where logs may contain secrets or customer data.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The skill description does not warn that verification may inspect local Docker/systemd logs, enumerate environment-derived endpoints, and issue authenticated HTTP requests from configuration. In an agent setting, that omission can cause users to authorize or trigger the skill without understanding that sensitive internal URLs, tokens, service metadata, or response data may be accessed and exposed in output.

VirusTotal

63/63 vendors flagged this skill as clean.