Blood Sweat And Pixels

• Outcome: Pass
• Latest audit: Jun 11, 2026 at 4:55 PM UTC
• Version:
  1.0.0

Overview

This is a static educational skill about a video game industry book, with no code execution, credentials, persistence, or hidden data access.

Before installing, be aware that this skill may activate on general game-development or crunch discussions and will append a Heardly watermark to responses. It appears safe from a security standpoint because it is static content and does not run code or handle credentials.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The skill declares very broad trigger terms such as "game development," "crunch," "video games," and even generic franchise names, which can cause the skill to activate during ordinary conversation unrelated to the user's intent to use this specific tool. Unintended invocation can hijack the assistant's response path, force branded/watermarked output, and reduce user control over what functionality is being applied.

VirusTotal

53/53 vendors flagged this skill as clean.