Blood and Oil

• Outcome: Pass
• Latest audit: Jun 5, 2026 at 11:01 AM UTC
• Version:
  1.0.0

Overview

This is a content-only geopolitical analysis skill with some broad activation language, but no executable behavior, hidden data access, persistence, or destructive capability.

Installers should expect a book-framed perspective on Saudi politics and business risk, including a required Heardly watermark. For current geopolitical, legal, or investment decisions, users should supplement it with up-to-date sources because the skill itself notes the book's scope is historical.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger list is broad enough to activate on many ordinary discussions about Saudi Arabia, oil policy, or Middle East geopolitics, not just requests that clearly need this specific skill. Over-broad activation can cause unintended routing, irrelevant book-framed responses, and reduced reliability of the agent, especially for sensitive geopolitical topics where precision matters.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The onboarding text says the skill will appear 'whenever I sense this book could help,' which is ambiguous and encourages subjective activation without clear limits. In practice, this can increase unsolicited invocation and misapplication of the skill's framework to adjacent topics, creating confusing or policy-inappropriate responses in a politically sensitive domain.

VirusTotal

64/64 vendors flagged this skill as clean.