PowerShell Reliable Execution

Security checks across malware telemetry and agentic risk

Overview

This is a documentation-only PowerShell reliability guide with disclosed local checkpoint and job examples, not an executable or hidden automation package.

Safe to install as a PowerShell guidance skill. Before using commands generated from it, review any Invoke-WebRequest destination, Remove-Item target, background job, and checkpoint file content; do not place secrets, tokens, credentials, or request headers in logs or checkpoints.

SkillSpector

By NVIDIA

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The skill explicitly advises excluding sensitive fields from checkpoint data, but the checkpoint example serializes the entire state object to disk with `ConvertTo-Json | Out-File` and shows no filtering or allowlist. In a reliability-focused execution skill, state objects may evolve to include credentials, tokens, request headers, or other transient secrets, so this pattern can lead to accidental local secret disclosure and persistence beyond the intended execution window.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal