Security audit

Cavepony

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed pony-themed response-compression tool, but its optional hooks can persistently change an agent’s behavior across sessions.

Install only if you want Cavepony to affect agent responses beyond individual commands. For CLI-only text compression, avoid the auto-activation hooks. If you use the hooks, review the generated Claude Code hook file and be prepared to remove it from the hooks directory to stop automatic activation permanently.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: The README instructs users to add a system-prompt snippet that enforces a response style on every reply, explicitly keeping it active across turns until a special override phrase is used. In an agent setting, persistent prompt-layer behavior without per-user opt-in can override user expectations, degrade clarity, and interfere with safety-critical or accessibility-sensitive responses by changing how all future outputs are produced.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The skill description uses broad, loosely scoped triggers such as 'when the user wants concise responses' and 'pony-flavored communication,' which can match many ordinary interactions and cause the skill to activate outside clear user intent. In an agent ecosystem, overly broad invocation criteria can lead to unintended style takeover, altered outputs, and interference with task accuracy or other higher-priority skills.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The system prompt snippet directs the agent to keep the behavior active on every response and not revert over time, which creates persistent style and vocabulary transformation without renewed user consent. This persistence is risky because it can degrade clarity, distort meaning through substitutions, and override normal agent behavior across unrelated tasks until manually disabled.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: The installed hook injects a persistent system prompt that forces a specific response style on every session start and explicitly states it should remain active for every response until a special opt-out command is used. This changes model behavior without prior user opt-in, reduces user control, and can interfere with clarity, policy handling, or downstream workflows that expect normal assistant behavior.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: The installer writes a hook that automatically modifies the assistant’s system prompt on every session start, forcing a persistent response style without explicit per-session user consent. While not code-execution or data-exfiltration behavior, it changes model behavior globally and can override user expectations, which is risky in an agent environment because hidden prompt injections can affect reliability, clarity, and downstream safety behavior.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: README.md:39

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: SKILL.md:74