Автоматический поиск клиентов (родителей) для репетитора по математике в группах ВКонтакте с умной фильтрацией и приоритизацией онлайн-запросов.

• Outcome: Pass
• Latest audit: May 28, 2026, 11:44 AM
• Version:
  1.0.0

Overview

This skill is a disclosed VK lead-monitoring helper, but users should treat its token, recurring scans, and saved lead data carefully.

Before installing, use a dedicated VK service token, monitor only groups you are allowed to process, keep the generated CSV private, set a retention/deletion practice for saved leads, and confirm how to pause or remove the 3-hour recurring task. Do not enable Google Sheets export unless you intentionally want the collected lead data copied there.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Context-Inappropriate Capability

Medium

• Confidence: 79% confidence
• Finding: Allowing export to Google Sheets introduces an additional external data destination not covered by the declared purpose or permissions, increasing the risk of unintended disclosure of collected personal data. In this skill, the collected records include author names, post links, and text snippets from VK, so an undocumented third-party sync materially broadens the privacy and exfiltration surface.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The README explicitly describes periodic scanning of VK groups and storing discovered leads in a CSV, but does not warn users about collection, retention, and handling of personal data from social posts. In a skill with internet access, file write access, and scheduled execution, this can normalize unattended scraping and local accumulation of personal information without user awareness or safeguards.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation tells the user to paste a VK access token into config.json, but does not clearly state that the skill will use that credential for automated network operations on the user's behalf. Because the skill has internet access and scheduled execution, users may unknowingly grant long-lived automated API access, increasing the risk of misuse, token leakage, or unexpected actions under their account/application context.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill is designed to collect, filter, and store personal data from VK posts and comments, including author names and message excerpts, but it does not warn the user about this privacy-sensitive processing. That omission is dangerous because users may enable recurring collection without understanding the scope of personal data retention or the legal/compliance implications.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill automatically schedules recurring monitoring every 3 hours, but this persistent behavior is not clearly surfaced as a user warning. Hidden or insufficiently disclosed scheduled execution is risky because it can lead to ongoing surveillance, repeated network access, and continued accumulation of personal data without the user appreciating that the task persists after initial setup.

VirusTotal

66/66 vendors flagged this skill as clean.