Science Sim Author

• Outcome: Pass
• Latest audit: May 28, 2026, 11:53 AM
• Version:
  0.1.3

Overview

This skill is an offline science-simulation generator, with the main caution that it intentionally generates runnable browser JavaScript.

Install this if you want an agent to generate offline single-file science simulations. Review any generated index.html before opening or sharing it when the input came from someone else, and confirm it contains no external scripts, network calls, telemetry, secrets, or unexpected browser permissions.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The skill description contains a very broad set of trigger phrases spanning general STEM, education, classroom demos, plots, sliders, and offline teaching tools. In agent-routing systems, this can cause the skill to activate for loosely related everyday requests, increasing the chance it is selected outside its intended scope and that untrusted user input is turned into generated code or files unnecessarily.

VirusTotal

64/64 vendors flagged this skill as clean.