Security audit
CAD Agent
Security checks across malware telemetry and agentic risk
Overview
The skill is coherent CAD tooling, but it asks users to run a background HTTP service that executes submitted code without documented access controls.
Install only if you are comfortable cloning and building the linked Docker project. Bind the service to localhost where possible, do not expose port 8123 to a shared or public network, inspect or pin the external repository before building, and stop the container when finished.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
64/64 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.