Security audit

Opc Board

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed feasibility-review workflow that uses local templates and a local intake form without hidden execution, persistence, or data exfiltration behavior.

Before installing, expect the skill to ask for business idea details, goals, constraints, technical stack, and personal resources so it can score the project. Treat its Go/No-Go output as advisory only, especially for legal, financial, medical, or regulated ideas.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The skill defines multiple broad, everyday trigger phrases such as '这个想法靠谱吗？' and '帮我拍砖', which are likely to appear in normal conversation outside the narrow intended use case. This can cause unintended invocation, routing users into this skill when they were asking for general advice rather than requesting a formal multi-advisor feasibility analysis.

Natural-Language Policy Violations

Medium

Confidence: 80% confidence
Finding: The skill presentation and instructions strongly bias toward Chinese or bilingual output, including bilingual headings and examples, without clearly tying language choice to the user's preference. While not a direct security exploit, this can override user expectations, increase confusion, and degrade safe interaction if important caveats or scoring details are delivered in an unintended language.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.