Doc

Security checks across malware telemetry and agentic risk

Overview

The skill appears purpose-aligned, with the main caution being that it may install required tools and clean up temporary files.

Before installing, review any package-manager or system-tool commands and approve them only if you trust the source. Keep cleanup limited to temporary or skill-owned paths, and avoid running deletion commands against user data.

SkillSpector

By NVIDIA

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill tells the agent to install packages/system tools and delete temporary files, but it does not require an explicit warning or consent flow before modifying the host environment or removing files. In practice this can lead to unauthorized system changes, package installation with elevated privileges, and accidental deletion of user-important data if paths are mishandled.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal