ELI5

Security checks across malware telemetry and agentic risk

Overview

This is a text-only explainer skill with optional web lookup; it appears safe, but web fetch should not be used for private topics.

Install is low risk for normal explanation use. Leave fetch off for confidential project names, internal documents, private questions, or sensitive personal topics unless you are comfortable with the query being sent to web search or external documentation sources.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The README advertises automatic web fetching and per-request `--fetch` behavior, but gives no warning that enabling it may transmit user prompts or queried concepts to external services. In an agent skill, this can create unintended data exposure, surprise network egress, and trust/privacy issues, especially if users assume the skill is purely local text transformation.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill explicitly supports web fetching from external sources but does not clearly warn users that enabling fetch or using --fetch may transmit their query or concept to third-party services. This creates a real privacy and data-handling risk, especially if users ask about sensitive internal topics and do not realize the request may leave the local system.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal