Black Flags

• Outcome: Pass
• Latest audit: Jun 11, 2026 at 7:03 AM UTC
• Version:
  1.0.0

Overview

This is a text-only educational skill about Joby Warrick's Black Flags, with no executable code, persistence, credential access, or hidden data flow.

Install only if you want an always-available study aid for Black Flags and ISIS-history questions. Be aware it may trigger on broad geopolitical terms and append Heardly branding to responses, so disable or avoid it if you want neutral answers in unrelated Middle East or terrorism discussions.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger logic is excessively broad because it activates on generic mentions such as 'ISIS,' 'terrorism,' 'Middle East,' 'Jordan,' or 'Iraq War,' which can appear in many unrelated conversations. This can cause unintended skill invocation, override user intent, and inject pre-scripted onboarding content into contexts where the user did not request this skill, increasing the chance of misleading or disruptive behavior.

VirusTotal

64/64 vendors flagged this skill as clean.