Security audit

Client Services Co-Pilot

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed client-services assistant that reads connected work tools to prepare follow-ups and meeting briefs, with no executable code or hidden behavior found.

Install only with connectors you are comfortable letting it search. Prefer least-privilege scopes, avoid connecting highly sensitive client matters unless needed, and review all generated drafts or saved docs before sharing them.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The README explicitly says the skill will pull recent mail, calendar, docs, and project activity into a meeting brief, but it provides no user-facing warning about the sensitivity of that data or the need to limit connector scope. In a plugin that aggregates cross-client information, this omission can lead users to authorize broad access without understanding privacy, confidentiality, or least-privilege implications, increasing the risk of unintended exposure of client data.

Vague Triggers

Low

Confidence: 76% confidence
Finding: The trigger phrase "client pulse" is broad and lacks clear scope, qualifiers, or exclusion conditions, so users may invoke it without realizing it could scan across multiple clients and communication sources. In this context, an underspecified trigger can cause over-collection or over-broad summarization of sensitive business information, though the README alone does not show an explicit exploit path.

VirusTotal

64/64 vendors flagged this plugin as clean.

View on VirusTotal