Security audit
Cancel Dispatch Run
Security checks across malware telemetry and agentic risk
Overview
The skill mostly does what it advertises, but its cancel command can act on path-like run IDs without enough containment before killing a local tmux session and rewriting metadata.
Install only if you understand that /cancel can kill local tmux sessions and rewrite run metadata. Prefer a fixed version that validates project and run-id characters, rejects .. and unexpected path segments, canonicalizes the target directory, and verifies it remains under the configured results base before sending tmux commands.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
65/65 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.