Build

• Outcome: Pass
• Latest audit: May 28, 2026 at 2:40 AM UTC
• Version:
  2.2.1

Overview

This is a disclosed build-automation skill that can edit code, run project commands, and commit changes, but those powers match its stated purpose.

Install only in repositories where you trust the plan files, Makefile/package scripts, workflow docs, and git hooks. Expect it to run commands, edit files, install/verify hooks, and create commits; review diffs and command output before relying on the result.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger set includes broad phrases like 'build it' and 'ship it', which can cause accidental invocation of a high-impact skill that edits files, runs shell commands, and commits code. In this context, overbroad activation is dangerous because the skill has powerful write/execute capabilities and may start making irreversible repository changes from casual user language.

VirusTotal

64/64 vendors flagged this skill as clean.