Security audit

gingiris-user-interview

Security checks across malware telemetry and agentic risk

Overview

The skill is a coherent user-research playbook, but it repeatedly normalizes mandatory screen recording, AI transcript processing, and personal-data collection without enough privacy controls.

Review before installing or using as an SOP. If adopted, make recording opt-in, warn participants to close or hide sensitive screens, provide a no-recording alternative, redact secrets and personal data before sending transcripts to AI or issue trackers, and define storage, access, and deletion rules for recordings and user profiles.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (7)

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The playbook instructs operators to make recording mandatory and to conduct broad multi-channel outreach, but it does not provide a clear privacy, consent, retention, or lawful-basis framework beyond a brief verbal consent prompt. In practice, this can lead users to collect sensitive interview data, screen contents, and contact information without adequate disclosure, minimization, or handling safeguards, creating privacy/compliance risk and potential misuse of personal data.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill instructs operators to require screen recording and to feed transcripts into AI systems and issue trackers, but it does not prominently require informed consent, data minimization, redaction, retention limits, or handling of sensitive information visible on shared screens. In a user interview context, screens and transcripts can easily capture personal data, credentials, business secrets, or regulated information, creating privacy, compliance, and secondary disclosure risk.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The playbook explicitly recommends screen recording, screenshots, and collection of device information during beta testing, but it does not instruct operators to obtain informed consent, minimize captured data, or avoid collecting sensitive content. In a real beta program, this can lead to over-collection of personal, confidential, or customer data from participants’ devices and workflows, creating privacy, compliance, and trust risks.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The guide directs staff to collect substantial personal profile data and to record interviews, but it does not define basic privacy controls such as data minimization, lawful basis/consent scope, retention period, storage protection, or access restrictions. In a user-interview operations playbook, this omission can lead teams to gather and retain sensitive personal data in an unsafe or noncompliant way, increasing risk of privacy violations and downstream exposure.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The document states that interviews must be screen-recorded, including shared screens, but it does not warn interviewers that screen shares may expose unrelated sensitive information such as emails, customer data, credentials, financial details, or internal documents. Because the skill is an operational SOP, users may follow it literally, creating avoidable privacy and confidentiality exposure during demos and recordings.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The template explicitly collects personal data such as name, email, company, social profiles, payment status, and interview records, but does not include guidance on data minimization, lawful basis/consent, retention, access controls, or handling of sensitive information. In a user interview and PMF operations playbook, this omission can lead teams to over-collect and improperly store PII, increasing privacy, compliance, and insider-misuse risk.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The invitation script states that the interview will be screen recorded for internal review, but it does not explain how consent will be obtained, where recordings will be stored, who can access them, or how long they will be retained. This creates a realistic risk of non-compliant recording practices and misuse of sensitive user statements, especially when interviews may reveal business, personal, or product-usage details.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.