Security audit
Acorn Prover
Security checks across malware telemetry and agentic risk
Overview
The skill is purpose-aligned for Acorn proof work, but its setup script can turn user-provided directory paths into shell code when the generated config is sourced.
Review this before installing. Use only simple trusted directory paths for `ACORN_LIB` and `ACORN_PROJECT` until the setup script quotes or escapes values safely; avoid paths with spaces, `$`, backticks, semicolons, or newlines. The skill otherwise appears focused on local Acorn proof workflows and does not show evidence of hidden data exfiltration or background persistence.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
66/66 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.