Security audit

Overseas Expansion Framework

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed markdown strategy framework for international expansion decisions, with no executable code or hidden data access.

This skill appears safe to install as a business strategy aid. Treat its output as planning guidance, not a substitute for local legal, tax, regulatory, or market advice, and be aware it may activate on broad phrases about going global.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The activation trigger includes broad, everyday phrases like 'we want to go global' and 'expand internationally', which can match many ordinary business conversations without enough narrowing context. In an agent system, this can cause over-activation of the skill, leading the model to inject the framework when it is only tangentially relevant and potentially crowd out better-suited guidance.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The 'When to Use' section repeats the vague trigger 'we want to go global' without sufficient specificity, reinforcing broad matching behavior beyond the already-scoped metadata. This increases the chance the skill is selected in loosely related discussions, which is more dangerous in context because the skill provides a fairly opinionated decision framework that may displace more appropriate product, GTM, or market-validation skills.

VirusTotal

56/56 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.