Color Convert

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:43 PM UTC
• Version:
  1.0.0

Overview

This is a low-risk color conversion and palette helper with no evidence of hidden data access or harmful behavior.

Install if you want a simple local color utility. Be aware it may activate for general color or palette-related requests, but the reviewed behavior is limited to design/color transformations and does not show sensitive access or persistence.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The manifest description includes a broad activation condition in Chinese ('trigger when the user needs color conversion, palette generation, contrast checking, palette generation'), which can cause the skill to activate for loosely related requests. Over-broad triggers are risky because they can hijack unrelated conversations or increase unintended tool invocation, though this particular skill is limited to low-risk color operations and does not expose sensitive capabilities.

VirusTotal

66/66 vendors flagged this skill as clean.