Security audit

sudo-gold

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward gold-market lookup skill that uses Tavily search as described and does not show hidden persistence, destructive behavior, or unrelated data access.

Install only if you are comfortable providing a Tavily API key and having Tavily receive gold-market search requests. Treat outputs as informational market summaries, not financial advice, and avoid including private portfolio details in prompts that may trigger external search.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The recommended invocation examples use broad natural-language phrases like '帮我分析一下黄金' and '现在黄金能买吗', which are common user requests and can cause the skill to auto-trigger more often than intended. That increases the chance of unintentional external searches and analysis being run when the user did not explicitly consent to using this specific skill or sending data to Tavily.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The documentation states that the skill uses Tavily search and an API key, but it does not clearly warn users that their queries may be transmitted to an external third-party service. This can lead to privacy and data-handling issues if users include sensitive financial intent, portfolio details, or other confidential information in prompts that are then sent off-platform.

VirusTotal

49/49 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.