CMIC Skill Scanner (macOS ARM64)

• Outcome: Pass
• Latest audit: May 28, 2026 at 2:30 PM UTC
• Version:
  0.9.0

Overview

This skill is a disclosed local scanner wrapper, with the main caution being optional upload of scan reports and the need to verify any scanner binary before running it.

Before installing, verify that any actual scanner binary is present and its SHA-256 matches the documented checksum, or build it from source if you do not trust the release host. Only use --upload-url with a trusted endpoint because scan findings can expose sensitive details about private skills or internal packages.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The installation instructions explicitly show sending detailed scan results, including full summaries and findings, to an external URL in an enterprise workflow. Because scan findings may contain sensitive metadata, internal paths, package contents, or other confidential review details, omitting any warning, consent step, redaction guidance, or trust-boundary explanation creates a real privacy and data-exposure risk.

VirusTotal

63/63 vendors flagged this skill as clean.