Security audit

MTV Rewind

Security checks across malware telemetry and agentic risk

Overview

This skill simply points users to a disclosed third-party MTV-style video player and does not install code, request credentials, or access local data.

Install it if you want agents to offer the MTV Rewind web player for retro music-video requests. Prefer explicit confirmation for vague requests like background music or unspecified videos, and avoid global installation unless you want all agents to have this behavior.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The skill description includes broad trigger phrases such as 'play MTV', 'put on some videos', and references to retro TV/music videos that can overlap with many general entertainment requests. In an agent marketplace or auto-routing system, this can cause the skill to activate for loosely related prompts and redirect users to an external site without sufficient specificity or user confirmation.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The 'When to Use' section contains vague triggers like 'Put on some music videos', 'What's on MTV?', and especially 'I need background vibes', which are not specific enough to uniquely justify this skill. Such broad matching increases the chance of inappropriate invocation and unsolicited navigation to an external streaming site, making the skill more dangerous in auto-selection contexts.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.