Peter Bugfix Loop

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:13 PM UTC
• Version:
  1.0.0

Overview

This skill is an instruction-only bug-fixing workflow with no hidden code, credential use, or data exfiltration behavior found.

Install this if you want an agent to follow a disciplined bugfix process. Because it can guide code changes, tests, commits, PRs, and reverts, keep normal review controls in place and confirm intent when you only want to discuss a bug rather than start the full workflow.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The activation cues are very broad bug-fixing phrases such as '修 bug' and '定位回归', which can easily match ordinary user conversation rather than an explicit request to invoke this skill. That can cause unintended triggering and steer the agent into a workflow with fixed output and external process handoffs when the user only wanted general discussion, creating control-boundary and reliability issues.

VirusTotal

66/66 vendors flagged this skill as clean.