Incident Triage

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:41 PM UTC
• Version:
  0.3.0

Overview

This skill is a disclosed incident-triage helper that uses GitHub CLI scripts and runbook guidance in ways that match its stated operational purpose.

Install this only for agents that should help with production or operational incidents. Use least-privilege GitHub CLI credentials, fill in the runbook template before relying on it, and require human confirmation before creating incident issues if automatic ticket creation is not desired.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The skill advertises very broad trigger phrases such as 'an alert fires,' 'something is down,' and 'investigating an incident,' which can cause the agent to invoke this skill in many loosely related contexts. Over-broad invocation increases the chance the skill activates on ambiguous operational language, pulling in alert text, links, or webhook content that may be attacker-controlled and causing unintended actions like triage workflows, GitHub correlation, or incident ticket creation.

VirusTotal

63/63 vendors flagged this skill as clean.