Test Sentinel

• Outcome: Review
• Latest audit: May 28, 2026, 1:45 AM
• Version:
  0.1.2

Overview

This looks like a legitimate testing helper, but it can broadly edit project files and automatically commit repository changes without clear user approval.

Install only if you are comfortable letting it read and modify your project and run local Node test/lint tools. Use it on a clean branch, review diffs before accepting fixes, and do not allow `git add -A` or automatic commits unless you have confirmed the staged files are exactly intended.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The manifest says the skill writes and runs tests, performs linting, and auto-fixes failures. Instructing the agent to stage all changes and create a git commit goes beyond those QA activities into source-control mutation, which is not an obvious requirement of test execution or test fixing itself.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: This markdown file directs the agent to stage and commit changes automatically, which modifies the user's repository state and history. The surrounding instructions do not provide any caution, confirmation requirement, or user-facing warning about making commits on the user's behalf.

VirusTotal

64/64 vendors flagged this skill as clean.