Metrics Track

Security checks across malware telemetry and agentic risk

Overview

This skill is a bounded PostHog metrics-planning helper that reads project context and writes a documentation file, with no evidence of hidden execution or data theft.

Before installing, confirm you are comfortable with the agent reading project documentation and writing docs/metrics-plan.md. If that file already exists, review the generated change before accepting it.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

Confidence: 88% confidence
Finding: The skill instructs the agent to write `docs/metrics-plan.md` automatically without first requiring explicit user confirmation. Even though the file content is low-risk documentation, unsolicited filesystem modification can surprise users, overwrite existing work, or create unwanted changes in a repository.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal