rename-fill

Security checks across malware telemetry and agentic risk

Overview

This is a real batch file-renaming skill, but it needs review because the included script can make persistent bulk filename changes without enforcing its own confirmation or tight path containment.

Install only if you are comfortable with a skill that can bulk-rename local files. Use it on a test folder or backup first, inspect the preview carefully, and avoid prefixes containing slashes, backslashes, '..', or path-like text.

SkillSpector

By NVIDIA

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The script performs destructive filesystem changes immediately after listing the planned operations, with no interactive confirmation or explicit safety gate in the code. This creates a mismatch with the advertised preview-and-confirm workflow and increases the risk of unintended bulk renames if the agent, caller, or user supplies the wrong prefix or directory.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal