Proposal and Cover Letter Interviewer & Improver (Continuous Questions and Memory for Better Proposals/Cover Letters by Getting to Know You)

• Outcome: Pass
• Latest audit: May 28, 2026, 8:23 AM
• Version:
  1.0.0

Overview

This instruction-only writing skill openly stores user-provided professional facts locally to improve future proposals and cover letters.

Install only if you are comfortable keeping a local, long-lived folder of professional and biographical facts. Periodically review skills/proposal-interview/, prune sensitive or outdated data yourself, and be especially deliberate before using the optional scheduled follow-up workflow.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly instructs storing personal and company information in local files, but it does not present a clear privacy notice, retention policy, or user consent step before collection begins. This creates a real privacy risk because users may disclose professional and personal facts without understanding where the data is kept, how long it persists, or who can access it.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The cron-based continuous learning workflow encourages repeated background collection of additional personal data over time, but there is no prominent warning or consent mechanism for scheduled collection and retention. That makes the risk more serious because users may not expect ongoing profiling or accumulation of sensitive details outside an actively supervised session.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The skill is designed to persistently accumulate user facts and approved statements across sessions, including via scheduled runs, which amounts to long-term profiling of personal and professional information. In this context, the danger is not remote code execution but privacy harm: overcollection, unintended retention, and increased exposure if the skill directory is accessed by other users, tools, backups, or logs.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The append-only requirement forces indefinite preservation of raw facts and approved statements, even when information becomes outdated, conflicting, or sensitive. In a skill dedicated to collecting personal narrative details, this materially increases the chance of unnecessary retention, accidental disclosure, and inability to honor correction or deletion requests.

VirusTotal

66/66 vendors flagged this skill as clean.