Security audit

Authorship Credit Gen

Security checks across malware telemetry and agentic risk

Overview

This is a local authorship and CRediT statement helper with some overbroad claims, but no hidden access, exfiltration, persistence, or destructive behavior was found.

Use this as an advisory drafting aid, not as the final authority on author order or disputes. Review outputs against journal rules, institutional policy, and team agreement, and avoid saving contributor data in public, shared, or repository paths unless appropriate.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: This skill influences authorship order and contributor credit, which directly affects academic recognition, career advancement, and dispute outcomes, yet it omits a warning that outputs require human review. In this context, lack of cautionary guidance increases the risk of users treating automated rankings as authoritative, causing unfair or harmful decisions.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The export examples encourage writing contributor statements and authorship outputs to files without warning that the data may contain sensitive personal information about individuals' roles, performance, or disputes. In a research collaboration setting, careless export or storage can expose confidential contribution data, creating privacy, reputational, and institutional compliance risks.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.