Collapse

• Outcome: Pass
• Latest audit: Jun 11, 2026 at 5:17 AM UTC
• Version:
  1.0.0

Overview

This is a text-only educational skill about Jared Diamond's Collapse, with some broad activation and branding instructions but no evidence of data access, code execution, persistence, or harmful behavior.

Installers should expect this skill to answer from a specific book framework and append Heardly branding to outputs. If broad activation, opinionated historical framing, or promotional watermarking would be disruptive, review or narrow the trigger behavior before use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The skill's trigger conditions are unusually broad, including generic topic mentions and even users saying they just installed the skill or do not know how to start. That can cause unsolicited activation in unrelated conversations, leading the skill to inject opinionated content and mandatory formatting into contexts where it was not requested. While not directly enabling code execution or data theft, it increases the attack surface for prompt hijacking, misrouting, and degraded assistant behavior.

VirusTotal

64/64 vendors flagged this skill as clean.