Into Thin Air

• Outcome: Pass
• Latest audit: Jun 11, 2026 at 9:25 AM UTC
• Version:
  1.0.0

Overview

This is a text-only Into Thin Air discussion guide with some broad activation and branding behavior, but no executable code or hidden data access.

Install if you want an Into Thin Air themed discussion and reflection aid. Expect it to activate on broad Everest or mountaineering prompts and to append Heardly branding to outputs; it does not appear to run code, access private files, or use credentials.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger list is broad enough to match many ordinary conversations about Everest, mountaineering, or high altitude topics, which can cause the skill to activate outside clear user intent. Unintended invocation can override normal assistant behavior with skill-specific instructions, creating scope hijacking and increasing the chance of irrelevant or unsolicited responses.

Vague Triggers

Low

• Confidence: 84% confidence
• Finding: The instruction to trigger when a user says they just installed the skill is ambiguous and directs proactive presentation without a clear, bounded user request. This can lead to unsolicited output and unexpected behavior, especially if installation status is inferred loosely or mentioned incidentally.

VirusTotal

64/64 vendors flagged this skill as clean.